[SR-Users] Re: xavp_params_explode broken comma in value?

Hi Daniel Thank you for your confirmation I was on the right track. Any recipe on how to solve if the value is the 'authentication' password taken from the database? As far as I understood the SIP RFC a comma is permitted in the SIP password itself, as it is never present cleartext in a sip header. Quick example of what I do when receiving a REGISTER with credentials to pull the password: $var(query) = "select user,password,language from sometable where auth_user = '" + $var(auth_user) + "' limit 1"; $var(qresult) = sql_xquery("database", "$var(query)", "userdata"); xavp_params_implode("userdata","$var(xuserdata)"); $var(xuserdata) is "user=JohnDoe;password=secret,password;language=de_CH" This is the stored in an $sht to be cached and available for a while and reducde SQL queries. I guess there is no way to have sql_xquery automatically quote result fields that need quoting. I could probably do select user,concat('"',password,'"'),language from sometable? This could also be a potential issue with variable injections via SQL. Immagine some use sets a password ";var=value" this would lead to this var being overwritten I guess. We are moving towards storing ha1 hashed passwords, so that would solve my issue I guess.