- /*
- * TODO: We really want to use PQescapeString, but this
- * isn't supported by the version of Postgresql in
- * Debian Stable. Roll on Woody and for now kludge it.
- */
- dodgychar = strchr(uids[i], '\'');
- while (dodgychar != NULL) {
- *dodgychar = ' ';
- dodgychar = strchr(uids[i], '\'');
+ safeuid = malloc(strlen(uids[i]) * 2 + 1);
+ if (safeuid != NULL) {
+ memset(safeuid, 0, strlen(uids[i]) * 2 + 1);
+ PQescapeString(safeuid, uids[i],
+ strlen(uids[i]));
+
+ snprintf(statement, 1023,
+ "INSERT INTO onak_uids "
+ "(keyid, uid, pri) "
+ "VALUES ('%llX', '%s', '%c')",
+ get_keyid(publickey),
+ safeuid,
+ (uids[i] == primary) ? 't' : 'f');
+ result = PQexec(dbconn, statement);
+
+ free(safeuid);
+ safeuid = NULL;