[db] Properly quote name and extension for SQL access
diff --git a/openbsc/src/db.c b/openbsc/src/db.c
index fd5dd81..2051288 100644
--- a/openbsc/src/db.c
+++ b/openbsc/src/db.c
@@ -689,8 +689,13 @@
{
dbi_result result;
char tmsi[14];
- char *q_tmsi;
+ char *q_tmsi, *q_name, *q_extension;
+ dbi_conn_quote_string_copy(conn,
+ subscriber->name, &q_name);
+ dbi_conn_quote_string_copy(conn,
+ subscriber->extension, &q_extension);
+
if (subscriber->tmsi != GSM_RESERVED_TMSI) {
sprintf(tmsi, "%u", subscriber->tmsi);
dbi_conn_quote_string_copy(conn,
@@ -708,14 +713,16 @@
"tmsi = %s, "
"lac = %i "
"WHERE imsi = %s ",
- subscriber->name,
- subscriber->extension,
+ q_name,
+ q_extension,
subscriber->authorized,
q_tmsi,
subscriber->lac,
subscriber->imsi);
free(q_tmsi);
+ free(q_name);
+ free(q_extension);
if (!result) {
LOGP(DDB, LOGL_ERROR, "Failed to update Subscriber (by IMSI).\n");