Private/ConvertTo-SQLLiteral.ps1
|
function ConvertTo-SQLLiteral { <# .SYNOPSIS Escapes a value for safe use inside a single-quoted OIM filter/SQL literal. .DESCRIPTION OIM "Where" filter clauses are built by interpolating values inside single quotes (e.g. "Name = '$Name'"). A value that itself contains a single quote will otherwise break out of the literal, corrupting the filter or allowing arbitrary filter injection. This doubles any embedded single quotes, which is the standard SQL-literal escape. .PARAMETER InputValue The raw value to embed inside a single-quoted filter literal. .EXAMPLE "O'Brien" | ConvertTo-SQLLiteral Returns "O''Brien" .OUTPUTS System.String #> [CmdletBinding()] [OutputType('System.String')] param( [parameter( Position = 0, Mandatory = $false, ValueFromPipeline = $true)] [AllowEmptyString()] [AllowNull()] [string]$InputValue ) Process { if ($null -eq $InputValue) { return $InputValue } $InputValue -replace "'", "''" } } |