Output sanitization within Progress ABL / 4GL

Question

Is there an analagous procedure to php's http://php.net/manual/en/function.mysql-real-escape-string.php for Progress 4GL / ABL or a best practice within the Progress community that is followed for writing sanitized text to external and untrusted entities (web sites, mysql servers and APIs)?

The QUOTE or QUERY-PREPARE functions will not work as they sanitize text for dynamic queries for Progress and not for external entities.

score 0 · Answer 1 · answered Aug 02 '12 at 20:34

The closest analogue to your cited example would be to write a function that does this:

 DEFINE VARIABLE ch-escape-chars AS CHARACTER    NO-UNDO.
 DEFINE VARIABLE ch-string       AS CHARACTER    NO-UNDO.
 DEFINE VARIABLE i-cnt           AS INTEGER      NO-UNDO.

 DO i-cnt = 1 TO LENGTH(ch-escape-char):

     ch-string = REPLACE(ch-string,
                         SUBSTRING(ch-escape-char, i-cnt, 1),
                         "~~" + SUBSTRING(ch-escape-char, i-cnt, 1)).

 END.

where

 ch-escape-chars are the characters you want escape'd. 
 ch-string is the incoming string.
 "~~" is the esacap'd escape character.

score 0 · Answer 2 · answered Aug 02 '12 at 23:23

It sounds like roll your own would be the only way. For my purposes I emulated the mysql_real_escape_string function

/* TODO progress auto changes all ASC(0) characters to space or ASC(20) in a non db string. */
/* the backslash needs to go first */
/* there is no concept of static vars in progress (non class) so global variables */
DEFINE VARIABLE cEscape AS CHARACTER EXTENT INITIAL [
 "~\",
 /*"~000",*/
 "~n",
 "~r",
 "'",
 "~""
 ]
 .
DEFINE VARIABLE cReplace AS CHARACTER EXTENT INITIAL [
 "\\",
 /*"\0",*/
 "\n",
 "\r",
 "\'",
 '\"'
 ]
 .

FUNCTION mysql_real_escape_string RETURNS CHARACTER (INPUT pcString AS CHAR):
    DEF VAR ii AS INTEGER NO-UNDO.

    MESSAGE pcString '->'.

    DO ii = 1 TO EXTENT(cEscape):
         ASSIGN pcString = REPLACE (pcString, cEscape[ii], cReplace[ii]).
    END.

    MESSAGE pcString.

    RETURN pcString.
END.

Output sanitization within Progress ABL / 4GL

2 Answers2