/*
* call-seq:
* PGconn.quote_ident( str ) -> String
* conn.quote_ident( str ) -> String
*
* Returns a string that is safe for inclusion in a SQL query
* as an identifier. Note: this is not a quote function for values,
* but for identifiers.
*
* For example, in a typical SQL query: +SELECT FOO FROM MYTABLE+
* The identifier +FOO+ is folded to lower case, so it actually means
* +foo+. If you really want to access the case-sensitive field name
* +FOO+, use this function like +PGconn.quote_ident('FOO')+, which
* will return +"FOO"+ (with double-quotes). PostgreSQL will see the
* double-quotes, and it will not fold to lower case.
*
* Similarly, this function also protects against special characters,
* and other things that might allow SQL injection if the identifier
* comes from an untrusted source.
*/
static VALUE
pgconn_s_quote_ident(VALUE self, VALUE in_str)
{
VALUE ret;
char *str = StringValuePtr(in_str);
/* result size at most NAMEDATALEN*2 plus surrounding
* double-quotes. */
char buffer[NAMEDATALEN*2+2];
unsigned int i=0,j=0;
if(strlen(str) >= NAMEDATALEN) {
rb_raise(rb_eArgError,
"Input string is longer than NAMEDATALEN-1 (%d)",
NAMEDATALEN-1);
}
buffer[j++] = '"';
for(i = 0; i < strlen(str) && str[i]; i++) {
if(str[i] == '"')
buffer[j++] = '"';
buffer[j++] = str[i];
}
buffer[j++] = '"';
ret = rb_str_new(buffer,j);
OBJ_INFECT(ret, in_str);
return ret;
}