Ticket #1387: sql-inject-breakpoints.diff

Padre/Breakpoints.pm

@@ -22 +22 @@
     my %bp_action;
     $bp_action{line} = $bp_line;
 
-    if ( $#{ $debug_breakpoints->select("WHERE filename = \"$current_file\" AND line_number = \"$bp_line\"") } >= 0 ) {
-
+    if ( $#{ $debug_breakpoints->select("WHERE filename = ? AND line_number = ?", $current_file, $bp_line ) } >= 0 ) {
         # say 'delete me';
         $editor->MarkerDelete( $bp_line - 1, Padre::Constant::MARKER_BREAKPOINT() );
         $editor->MarkerDelete( $bp_line - 1, Padre::Constant::MARKER_NOT_BREAKABLE() );
-        $debug_breakpoints->delete("WHERE filename = \"$current_file\" AND line_number = \"$bp_line\"");
+        $debug_breakpoints->delete("WHERE filename = ? AND line_number = ?", $current_file, $bp_line);
         $bp_action{action} = 'delete';
     } else {
-
         # say 'create me';
         $editor->MarkerAdd( $bp_line - 1, Padre::Constant::MARKER_BREAKPOINT() );
         $debug_breakpoints->create(
@@ -55 +53 @@
     my $editor            = Padre::Current->editor;
     my $debug_breakpoints = ('Padre::DB::DebugBreakpoints');
     my $current_file      = $editor->{Document}->filename;
-    my $sql_select        = "WHERE BY filename = \"$current_file\" ASC, line_number ASC";
-    my @tuples            = $debug_breakpoints->select($sql_select);
+    my $sql_select        = "WHERE BY filename = ? ASC, line_number ASC";
+    my @tuples            = $debug_breakpoints->select($sql_select, $current_file);
 
     for ( 0 .. $#tuples ) {