|
16 | 16 | from lib.core.common import isTechniqueAvailable |
17 | 17 | from lib.core.common import readInput |
18 | 18 | from lib.core.common import safeSQLIdentificatorNaming |
| 19 | +from lib.core.common import safeStringFormat |
19 | 20 | from lib.core.common import unArrayizeValue |
20 | 21 | from lib.core.common import unsafeSQLIdentificatorNaming |
21 | 22 | from lib.core.data import conf |
@@ -157,8 +158,6 @@ def searchTable(self): |
157 | 158 |
|
158 | 159 | foundTbls = {} |
159 | 160 | tblList = conf.tbl.split(",") |
160 | | - import pdb |
161 | | - pdb.set_trace() |
162 | 161 | rootQuery = queries[Backend.getIdentifiedDbms()].search_table |
163 | 162 | tblCond = rootQuery.inband.condition |
164 | 163 | dbCond = rootQuery.inband.condition2 |
@@ -300,13 +299,16 @@ def searchTable(self): |
300 | 299 | for index in indexRange: |
301 | 300 | query = rootQuery.blind.query2 |
302 | 301 |
|
| 302 | + if query.endswith("'%s')"): |
| 303 | + query = query[:-1] + " AND %s)" % tblQuery |
| 304 | + else: |
| 305 | + query += " AND %s" % tblQuery |
| 306 | + |
303 | 307 | if Backend.isDbms(DBMS.FIREBIRD): |
304 | | - query = query % index |
| 308 | + query = safeStringFormat(query, index) |
305 | 309 |
|
306 | 310 | if Backend.getIdentifiedDbms() not in (DBMS.SQLITE, DBMS.FIREBIRD): |
307 | | - query = query % unsafeSQLIdentificatorNaming(db) |
308 | | - |
309 | | - query += " AND %s" % tblQuery |
| 311 | + query = safeStringFormat(query, unsafeSQLIdentificatorNaming(db)) |
310 | 312 |
|
311 | 313 | if not Backend.isDbms(DBMS.FIREBIRD): |
312 | 314 | query = agent.limitQuery(index, query) |
|
0 commit comments