# Escaping double quotes with ODBC functions

**URL:** <https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028>\
**Category:** Asterisk Dialplan\
**Created:** [February 17, 2024, 5:47pm UTC](https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028 "2024-02-17T17:47:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ldardini](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/ldardini/32/48_2.png) [@ldardini](https://community.asterisk.org/u/ldardini)\
**Post date:** [February 17, 2024, 5:47pm UTC](https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028/1 "2024-02-17T17:47:30Z")

</div>

Before reporting as a bug, I’d like to check with you if I am doing something wrong. When using an ODBC function, if any of the fields contains a double quote, the field ordering and value results are wrong. I have tried with the use of the ARRAY and HASH function

If I use a simple function like:

[QUERY\_BUG]  
dsn=asterisk1,asterisk2  
synopsis=Get a double quote  
readsql=SELECT "George \“o Neal” as name,987897 as number from DUAL

With a simple dialplan

```
    9998 => {
         NoOp(This is a test);
         Set(ARRAY(name,number)=${ODBC_QUERY_BUG()});
         NoOp(The name value is ${name} and the number value is ${number});
         Set(HASH(varhash)=${ODBC_QUERY_BUG()});
         NoOp(The varhash name value is ${HASH(varhash,name)} and the varhash number value is ${HASH(varhash,number)});
         Hangup();
    }

```

The result is not what is expected:

```
-- Executing [9998@authenticated:1] NoOp("PJSIP/104-DEVEL-000000cc", "This is a test") in new stack
-- Executing [9998@authenticated:2] Set("PJSIP/104-DEVEL-000000cc", "ARRAY(name,number)=George "o Neal,987897") in new stack
-- Executing [9998@authenticated:3] NoOp("PJSIP/104-DEVEL-000000cc", "The name value is George o Neal,987897 and the number value is ") in new stack
-- Executing [9998@authenticated:4] Set("PJSIP/104-DEVEL-000000cc", "HASH(varhash)=George "o Neal,987897") in new stack
-- Executing [9998@authenticated:5] NoOp("PJSIP/104-DEVEL-000000cc", "The varhash name value is George o Neal,987897 and the varhash number value is ") in new stack

```

Is there a way to get around this problem?

---

<div class="post-metadata">

**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\
**Post date:** [February 17, 2024, 5:57pm UTC](https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028/2 "2024-02-17T17:57:48Z")

</div>

> **[Quotation Marks in MySQL: Syntax Simplified | Atlassian](https://www.atlassian.com/data/sql/single-double-quote-and-backticks-in-mysql-queries)**
>
> Master MySQL syntax: Learn the right use of single, double quotes, and backticks for error-free database queries.

Other SQL implementations may differ.

---

<div class="post-metadata">

**Author:** ![ldardini](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/ldardini/32/48_2.png) [@ldardini](https://community.asterisk.org/u/ldardini)\
**Post date:** [February 17, 2024, 6:17pm UTC](https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028/3 "2024-02-17T18:17:39Z")

</div>

Thank you for the reply, I was not aware of that page. However, that doesn’t completely solve the issue because when the double quote is in the MySQL table data, escaping it while reading is a very dirty solution. I suppose the escaping should be done in the ODBC driver, not by the user in this way:

[QUERY\_BUG]  
dsn=asterisk1,asterisk2  
synopsis=Get a double quote  
readsql=SELECT REPLACE(‘George "o Neal’,‘"’,‘“”’) as name,987897 as number from DUAL

---

<div class="post-metadata">

**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\
**Post date:** [February 17, 2024, 7:16pm UTC](https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028/4 "2024-02-17T19:16:29Z")

</div>

You need to filter the string, if you don’t want to fall victim to an SQL injection attack.

The way that SQL handles this properly is that you put question marks as placeholders for the values, and then provide a binary data structure containing the actual values, in the same order, meaning that the SQL parser never sees the values. However quick and dirty support for SQL just works with the values directly in the SQL.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\
**Post date:** [March 18, 2024, 7:17pm UTC](https://community.asterisk.org/t/escaping-double-quotes-with-odbc-functions/101028/5 "2024-03-18T19:17:10Z")

</div>

Closed on March 18, 2024, 7:17pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.