Add sqlEscapeString

app/src/main/java/com/hippo/ehviewer/EhDB.java

@@ -42,6 +42,7 @@ import com.hippo.ehviewer.dao.LocalFavoriteInfo;
 import com.hippo.ehviewer.dao.LocalFavoritesDao;
 import com.hippo.ehviewer.dao.QuickSearch;
 import com.hippo.ehviewer.dao.QuickSearchDao;
+import com.hippo.util.SqlUtils;
 import com.hippo.yorozuya.sparse.SparseJLArray;
 
 import java.util.ArrayList;
@@ -428,9 +429,10 @@ public class EhDB {
     }
 
     public static synchronized List<GalleryInfo> searchLocalFavorites(String query) {
+        query = SqlUtils.sqlEscapeString("%" + query+ "%");
         LocalFavoritesDao dao = sDaoSession.getLocalFavoritesDao();
         List<LocalFavoriteInfo> list = dao.queryBuilder().orderAsc(LocalFavoritesDao.Properties.Time)
-                .where(LocalFavoritesDao.Properties.Title.like("%" + query+ "%")).list();
+                .where(LocalFavoritesDao.Properties.Title.like(query)).list();
         List<GalleryInfo> result = new ArrayList<>();
         result.addAll(list);
         return result;

app/src/main/java/com/hippo/ehviewer/widget/SearchDatabase.java

@@ -23,6 +23,7 @@ import android.database.sqlite.SQLiteDatabase;
 import android.database.sqlite.SQLiteOpenHelper;
 import android.text.TextUtils;
 
+import com.hippo.util.SqlUtils;
 import com.hippo.yorozuya.Say;
 
 import java.util.LinkedList;
@@ -64,7 +65,7 @@ public class SearchDatabase {
         sb.append("SELECT * FROM ").append(TABLE_SUGGESTIONS);
         if (!TextUtils.isEmpty(prefix)) {
             sb.append(" WHERE ").append(COLUMN_QUERY).append(" LIKE '")
-                    .append(prefix).append("%'");
+                    .append(SqlUtils.sqlEscapeString(prefix)).append("%'");
         }
         sb.append(" ORDER BY ").append(COLUMN_DATE).append(" DESC")
                 .append(" LIMIT 5");

app/src/main/java/com/hippo/util/SqlUtils.java

@@ -54,4 +54,19 @@ public class SqlUtils {
             dropTable(db, tableName);
         }
     }
+
+    public static String sqlEscapeString(String value) {
+        StringBuilder sb = new StringBuilder();
+
+        int length = value.length();
+        for (int i = 0; i < length; i++) {
+            char c = value.charAt(i);
+            if (c == '\'') {
+                sb.append('\'');
+            }
+            sb.append(c);
+        }
+
+        return sb.toString();
+    }
 }