@@ -69,7 +69,7 @@ QgsMssqlProvider::QgsMssqlProvider( QString uri )
69
69
mValid = true ;
70
70
71
71
mUseWkb = false ;
72
- mSkipFailures = true ;
72
+ mSkipFailures = false ;
73
73
74
74
mUseEstimatedMetadata = anUri.useEstimatedMetadata ();
75
75
@@ -274,18 +274,18 @@ QVariant::Type QgsMssqlProvider::DecodeSqlType( QString sqlTypeName )
274
274
}
275
275
else if ( sqlTypeName.startsWith ( " date" , Qt::CaseInsensitive ) )
276
276
{
277
- type = QVariant::Date ;
277
+ type = QVariant::String ;
278
278
}
279
279
else if ( sqlTypeName.startsWith ( " datetime" , Qt::CaseInsensitive ) ||
280
280
sqlTypeName.startsWith ( " smalldatetime" , Qt::CaseInsensitive ) ||
281
281
sqlTypeName.startsWith ( " datetime2" , Qt::CaseInsensitive ) )
282
282
{
283
- type = QVariant::DateTime ;
283
+ type = QVariant::String ;
284
284
}
285
285
else if ( sqlTypeName.startsWith ( " time" , Qt::CaseInsensitive ) ||
286
286
sqlTypeName.startsWith ( " timestamp" , Qt::CaseInsensitive ) )
287
287
{
288
- type = QVariant::Time ;
288
+ type = QVariant::String ;
289
289
}
290
290
else
291
291
{
@@ -755,6 +755,7 @@ bool QgsMssqlProvider::addFeatures( QgsFeatureList & flist )
755
755
756
756
statement += " ) VALUES (" + values + " )" ;
757
757
758
+ // use prepared statement to prevent from sql injection
758
759
if ( !mQuery .prepare ( statement ) )
759
760
{
760
761
QString msg = mQuery .lastError ().text ();
@@ -775,8 +776,34 @@ bool QgsMssqlProvider::addFeatures( QgsFeatureList & flist )
775
776
if ( fld.name ().isEmpty () )
776
777
continue ; // invalid
777
778
778
- // use prepared statement to prevent from sql injection
779
- mQuery .addBindValue ( *it2 );
779
+ QVariant::Type type = fld.type ();
780
+ if ( it2->isNull () || !it2->isValid () )
781
+ {
782
+ // binding null values
783
+ if ( type == QVariant::Date || type == QVariant::DateTime )
784
+ mQuery .addBindValue ( QVariant ( QVariant::String ) );
785
+ else
786
+ mQuery .addBindValue ( QVariant ( type ) );
787
+ }
788
+ else if ( type == QVariant::Int )
789
+ {
790
+ // binding an INTEGER value
791
+ mQuery .addBindValue ( it2->toInt () );
792
+ }
793
+ else if ( type == QVariant::Double )
794
+ {
795
+ // binding a DOUBLE value
796
+ mQuery .addBindValue ( it2->toDouble () );
797
+ }
798
+ else if ( type == QVariant::String )
799
+ {
800
+ // binding a TEXT value
801
+ mQuery .addBindValue ( it2->toString () );
802
+ }
803
+ else
804
+ {
805
+ mQuery .addBindValue ( *it2 );
806
+ }
780
807
}
781
808
782
809
if ( !mGeometryColName .isEmpty () )
@@ -932,6 +959,7 @@ bool QgsMssqlProvider::changeAttributeValues( const QgsChangedAttributesMap & at
932
959
// set attribute filter
933
960
statement += QString ( " WHERE [%1]=%2" ).arg ( mFidColName , FID_TO_STRING ( fid ) );
934
961
962
+ // use prepared statement to prevent from sql injection
935
963
if ( !mQuery .prepare ( statement ) )
936
964
{
937
965
QString msg = mQuery .lastError ().text ();
@@ -949,8 +977,34 @@ bool QgsMssqlProvider::changeAttributeValues( const QgsChangedAttributesMap & at
949
977
if ( fld.name ().isEmpty () )
950
978
continue ; // invalid
951
979
952
- // use prepared statement to prevent from sql injection
953
- mQuery .addBindValue ( *it2 );
980
+ QVariant::Type type = fld.type ();
981
+ if ( it2->isNull () || !it2->isValid () )
982
+ {
983
+ // binding null values
984
+ if ( type == QVariant::Date || type == QVariant::DateTime )
985
+ mQuery .addBindValue ( QVariant ( QVariant::String ) );
986
+ else
987
+ mQuery .addBindValue ( QVariant ( type ) );
988
+ }
989
+ else if ( type == QVariant::Int )
990
+ {
991
+ // binding an INTEGER value
992
+ mQuery .addBindValue ( it2->toInt () );
993
+ }
994
+ else if ( type == QVariant::Double )
995
+ {
996
+ // binding a DOUBLE value
997
+ mQuery .addBindValue ( it2->toDouble () );
998
+ }
999
+ else if ( type == QVariant::String )
1000
+ {
1001
+ // binding a TEXT value
1002
+ mQuery .addBindValue ( it2->toString () );
1003
+ }
1004
+ else
1005
+ {
1006
+ mQuery .addBindValue ( *it2 );
1007
+ }
954
1008
}
955
1009
956
1010
if ( !mQuery .exec () )
0 commit comments