Closed bug with ' and database\nimproved LiveTV receiver

7 files changed, 143 insertions, 185 deletions

diff --git a/database/database.cpp b/database/database.cpp
index fa2e9b8..4355cbd 100644
--- a/database/database.cpp
+++ b/database/database.cpp
@@ -39,7 +39,7 @@ cSQLiteDatabase* cSQLiteDatabase::getInstance(){
         return NULL;
 }
 
-int cSQLiteDatabase::execStatement(const char* Statement){
+int cSQLiteDatabase::exec(const char* Statement){
     char* Error;
     if(!this->mDatabase){
         ERROR("Database not open. Cannot continue");
@@ -52,6 +52,7 @@ int cSQLiteDatabase::execStatement(const char* Statement){
     if(sqlite3_exec(this->mDatabase, Statement, cSQLiteDatabase::getResultRow, (cSQLiteDatabase*)this, &Error)!=SQLITE_OK){
         ERROR("Database error: %s", Error);
         ERROR("Statement was: %s", Statement);
+        delete this->mRows; this->mRows = NULL;
         sqlite3_free(Error);
         return -1;
     }
@@ -60,6 +61,24 @@ int cSQLiteDatabase::execStatement(const char* Statement){
     return 0;
 }
 
+const char* cSQLiteDatabase::sprintf(const char* Format, ...){
+    va_list vlist;
+    va_start(vlist, Format);
+    char* SQLStatement = sqlite3_vmprintf(Format, vlist);
+    va_end(vlist);
+    return SQLStatement;
+}
+
+int cSQLiteDatabase::execStatement(const char* Statement, ...){
+    va_list vlist;
+    va_start(vlist, Statement);
+    char* SQLStatement = sqlite3_vmprintf(Statement, vlist);
+    va_end(vlist);
+    int ret = this->exec(SQLStatement);
+    sqlite3_free(SQLStatement);
+    return ret;
+}
+
 int cSQLiteDatabase::getResultRow(void* DB, int NumCols, char** Values, char** ColNames){
     cRow* Row = new cRow;
     Row->ColCount = NumCols;
@@ -135,7 +154,7 @@ bool cRow::fetchColumn(char** Column, char** Value){
     #endif
     *Column = strdup0(this->Columns[currentCol]);
     if(this->Values[currentCol]){
-        *Value = strcasecmp(this->Values[currentCol],"NULL")?strdup0(this->Values[currentCol]):NULL;
+        *Value = strcasecmp(this->Values[currentCol],"NULL")?strdup(this->Values[currentCol]):NULL;
     }
     else {
         *Value = NULL;
diff --git a/database/database.h b/database/database.h
index cc3ad12..ecd43e4 100644
--- a/database/database.h
+++ b/database/database.h
@@ -824,6 +824,7 @@ public:
 };
 
 class cSQLiteDatabase {
+    friend class cStatement;
 private:
     bool        mAutoCommit;
     bool        mActiveTransaction;
@@ -836,13 +837,15 @@ private:
     int initializeTables();
     int initializeTriggers();
     static int getResultRow(void* DB, int NumCols, char** Values, char** ColNames);
+    int exec(const char* Statement);
 public:
+    static const char* sprintf(const char* Format, ...);
     virtual ~cSQLiteDatabase();
     static cSQLiteDatabase* getInstance();
     int getResultCount() const { return this->mRows->Count(); }
     long getLastInsertRowID() const;
     cRows* getResultRows() const { return this->mRows; }
-    int execStatement(const char* Statement);
+    int execStatement(const char* Statement, ...);
     void startTransaction();
     void commitTransaction();
     void rollbackTransaction();
diff --git a/database/metadata.cpp b/database/metadata.cpp
index 4f18009..ebe530b 100644
--- a/database/metadata.cpp
+++ b/database/metadata.cpp
@@ -61,12 +61,10 @@ bool cMediaDatabase::init(){
 }
 
 void cMediaDatabase::updateSystemID(){
-    cString Statement = cString::sprintf("INSERT OR REPLACE INTO %s (Key,Value) VALUES ('%s','%d')",
-            SQLITE_TABLE_SYSTEM,
-            KEY_SYSTEM_UPDATE_ID,
-            this->getSystemUpdateID()+1
-            );
-    this->mDatabase->execStatement(Statement);
+    this->mDatabase->execStatement("INSERT OR REPLACE INTO %s (Key,Value) VALUES (%Q,%d)",
+                                    SQLITE_TABLE_SYSTEM,
+                                    KEY_SYSTEM_UPDATE_ID,
+                                    this->getSystemUpdateID()+1);
 }
 
 const char* cMediaDatabase::getContainerUpdateIDs(){
@@ -74,11 +72,9 @@ const char* cMediaDatabase::getContainerUpdateIDs(){
 }
 
 unsigned int cMediaDatabase::getSystemUpdateID(){
-    cString Statement = cString::sprintf("SELECT Value FROM %s WHERE Key='%s'",
-            SQLITE_TABLE_SYSTEM,
-            KEY_SYSTEM_UPDATE_ID
-            );
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement("SELECT Value FROM %s WHERE Key=%Q",
+                                        SQLITE_TABLE_SYSTEM,
+                                        KEY_SYSTEM_UPDATE_ID)){
         ERROR("Error while executing statement");
         return 0;
     }
@@ -99,9 +95,9 @@ unsigned int cMediaDatabase::getSystemUpdateID(){
 
 cUPnPObjectID cMediaDatabase::getNextObjectID(){
     cString Statement, Column, Value;
-    const char* Format = "SELECT Key FROM %s WHERE KeyID=%s";
-    Statement = cString::sprintf(Format, SQLITE_TABLE_PRIMARY_KEYS, PK_OBJECTS);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement("SELECT Key FROM %s WHERE KeyID=%Q",
+                                      SQLITE_TABLE_PRIMARY_KEYS,
+                                      PK_OBJECTS)){
         ERROR("Error while executing statement");
         return 0;
     }
@@ -130,17 +126,12 @@ int cMediaDatabase::addFastFind(cUPnPClassObject* Object, const char* FastFind){
         return -1;
     }
 
-    char* escapedFastFind;
-    escapeSQLite(FastFind, &escapedFastFind);
-    cString Statement = cString::sprintf("INSERT OR REPLACE INTO %s (%s, %s) VALUES ('%s', '%s')",
+    if(this->mDatabase->execStatement("INSERT OR REPLACE INTO %s (%s, %s) VALUES (%Q, %Q)",
             SQLITE_TABLE_ITEMFINDER,
             SQLITE_COL_OBJECTID,
             SQLITE_COL_ITEMFINDER,
             *Object->getID(),
-            escapedFastFind
-                                        );
-    free(escapedFastFind);
-    if(this->mDatabase->execStatement(Statement)){
+            FastFind)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -150,10 +141,12 @@ int cMediaDatabase::addFastFind(cUPnPClassObject* Object, const char* FastFind){
 cUPnPClassObject* cMediaDatabase::getObjectByFastFind(const char* FastFind){
     if(!FastFind) return NULL;
     MESSAGE("Try to find Object with identifier %s", FastFind);
-    cString Statement, Column, Value;
-    const char* Format = "SELECT %s FROM %s WHERE %s='%s'";
-    Statement = cString::sprintf(Format, SQLITE_COL_OBJECTID, SQLITE_TABLE_ITEMFINDER, SQLITE_COL_ITEMFINDER, FastFind);
-    if(this->mDatabase->execStatement(Statement)){
+    cString Column, Value;
+    if(this->mDatabase->execStatement("SELECT %s FROM %s WHERE %s=%Q",
+                                       SQLITE_COL_OBJECTID,
+                                       SQLITE_TABLE_ITEMFINDER,
+                                       SQLITE_COL_ITEMFINDER,
+                                       FastFind)){
         ERROR("Error while executing statement");
         return 0;
     }
diff --git a/database/object.cpp b/database/object.cpp
index 1ef4fe2..94d9415 100644
--- a/database/object.cpp
+++ b/database/object.cpp
@@ -265,7 +265,7 @@ bool cUPnPClassObject::getProperty(const char* Property, char** Value) const {
         Val = this->isRestricted()?"1":"0";
     }
     else if(!strcasecmp(Property, SQLITE_COL_WRITESTATUS) || !strcasecmp(Property, UPNP_PROP_WRITESTATUS)){
-        Val = cString::sprintf("%d",this->getWriteStatus());
+        Val = itoa(this->getWriteStatus());
     }
     else {
         ERROR("Invalid property '%s'", Property);
@@ -1035,11 +1035,10 @@ void cUPnPObjectFactory::unregisterMediator(const char* UPnPClass, bool freeMedi
 }
 
 cMediatorInterface* cUPnPObjectFactory::findMediatorByID(cUPnPObjectID ID){
-    cString Format = "SELECT %s FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL, Class = NULL;
+    cString Format = "SELECT %s FROM %s WHERE %s=%Q";
+    cString Column = NULL, Value = NULL, Class = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_COL_CLASS, SQLITE_TABLE_OBJECTS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_COL_CLASS, SQLITE_TABLE_OBJECTS, SQLITE_COL_OBJECTID, *ID)){
         ERROR("Error while executing statement");
         return NULL;
     }
@@ -1142,10 +1141,8 @@ int cUPnPObjectMediator::saveObject(cUPnPClassObject* Object){
 }
 
 int cUPnPObjectMediator::deleteObject(cUPnPClassObject* Object){
-    cString Statement = NULL;
-    cString Format = "DELETE FROM %s WHERE %s=%s";
-    Statement = cString::sprintf(Format, SQLITE_TABLE_OBJECTS, SQLITE_COL_OBJECTID, *Object->getID());
-    if(this->mDatabase->execStatement(Statement)){
+    cString Format = "DELETE FROM %s WHERE %s=%Q";
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_OBJECTS, SQLITE_COL_OBJECTID, *Object->getID())){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1192,9 +1189,7 @@ int cUPnPObjectMediator::initializeObject(cUPnPClassObject* Object, const char*
         ERROR("Error while setting restriction");
         return -1;
     }
-    char* escapedTitle;
-    escapeSQLite(Object->getTitle(), &escapedTitle);
-    cString Statement = cString::sprintf("INSERT INTO %s (%s, %s, %s, %s, %s) VALUES (%s, %s, '%s', '%s', %d)",
+    if(this->mDatabase->execStatement("INSERT INTO %s (%s, %s, %s, %s, %s) VALUES (%s, %s, %Q, %Q, %d)",
                                          SQLITE_TABLE_OBJECTS,
                                          SQLITE_COL_OBJECTID,
                                          SQLITE_COL_PARENTID,
@@ -1204,14 +1199,11 @@ int cUPnPObjectMediator::initializeObject(cUPnPClassObject* Object, const char*
                                          *Object->getID(),
                                          *Object->getParentID(),
                                          Object->getClass(),
-                                         escapedTitle,
-                                         Object->isRestricted()?1:0
-                                        );
-    if(this->mDatabase->execStatement(Statement)){
+                                         Object->getTitle(),
+                                         Object->isRestricted()?1:0)){
         ERROR("Error while executing statement");
         return -1;
     }
-    free(escapedTitle);
     return 0;
 }
 
@@ -1223,7 +1215,6 @@ int cUPnPObjectMediator::objectToDatabase(cUPnPClassObject* Object){
     MESSAGE("Updating object #%s", *Object->getID());
     cString Format = "UPDATE %s SET %s WHERE %s='%s'";
     //cString Format = "INSERT OR REPLACE INTO %s (%s) VALUES (%s);";
-    cString Statement=NULL;
     cString Set=NULL;
     //cString Columns=NULL, Values=NULL;
     char *Value=NULL;
@@ -1238,21 +1229,13 @@ int cUPnPObjectMediator::objectToDatabase(cUPnPClassObject* Object){
         NULL
     };
     for(cString* Property = Properties; *(*Property)!=NULL; Property++){
-        //Columns = cString::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
         if(!Object->getProperty(*Property, &Value)){
             ERROR("No such property '%s' in object with ID '%s'",*(*Property),*Object->getID());
             return -1;
         }
-        char *escapedValue;
-        escapeSQLite(Value, &escapedValue);
-        MESSAGE("Set %s to %s", *(*Property), escapedValue);
-        //Values = cString::sprintf("%s%s'%s'", *Values?*Values:"", *Values?",":"", Value?Value:"NULL");
-        Set = cString::sprintf("%s%s%s='%s'", *Set?*Set:"", *Set?",":"", *(*Property), escapedValue?escapedValue:"NULL");
-        
+        Set = cSQLiteDatabase::sprintf("%s%s%s=%Q", *Set?*Set:"", *Set?",":"", *(*Property), Value);
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_OBJECTS, *Set, SQLITE_COL_OBJECTID, *Object->mLastID);
-    //Statement = cString::sprintf(Format, SQLITE_TABLE_OBJECTS, *Columns, *Values);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_OBJECTS, *Set, SQLITE_COL_OBJECTID, *Object->mLastID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1262,11 +1245,12 @@ int cUPnPObjectMediator::objectToDatabase(cUPnPClassObject* Object){
 }
 
 int cUPnPObjectMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObjectID ID){
-    cString Format = "SELECT * FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL;
+    cString Column = NULL, Value = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_TABLE_OBJECTS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement("SELECT * FROM %s WHERE %s=%Q",
+                                        SQLITE_TABLE_OBJECTS,
+                                        SQLITE_COL_OBJECTID,
+                                        *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1345,7 +1329,7 @@ cUPnPItemMediator::cUPnPItemMediator(cMediaDatabase* MediaDatabase) :
 int cUPnPItemMediator::objectToDatabase(cUPnPClassObject* Object){
     if(cUPnPObjectMediator::objectToDatabase(Object)) return -1;
     cString Format = "INSERT OR REPLACE INTO %s (%s) VALUES (%s);";
-    cString Statement=NULL, Columns=NULL, Values=NULL;
+    cString Columns=NULL, Values=NULL;
     char *Value=NULL;
     cString Properties[] = {
         SQLITE_COL_OBJECTID,
@@ -1353,18 +1337,15 @@ int cUPnPItemMediator::objectToDatabase(cUPnPClassObject* Object){
         NULL
     };
     for(cString* Property = Properties; *(*Property); Property++){
-        Columns = cString::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
+        Columns = cSQLiteDatabase::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
         if(!Object->getProperty(*Property, &Value)){
             ERROR("No such property '%s' in object with ID '%s'",*(*Property),*Object->getID());
             return -1;
         }
-        char *escapedValue;
-        escapeSQLite(Value, &escapedValue);
-        Values = cString::sprintf("%s%s'%s'", *Values?*Values:"", *Values?",":"", escapedValue?escapedValue:"NULL");
+        Values = cSQLiteDatabase::sprintf("%s%s%Q", *Values?*Values:"", *Values?",":"", Value);
         
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_ITEMS, *Columns, *Values);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_ITEMS, *Columns, *Values)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1377,11 +1358,12 @@ int cUPnPItemMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObjectID
         return -1;
     }
     cUPnPClassItem* Item = (cUPnPClassItem*) Object;
-    cString Format = "SELECT * FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL;
+    cString Column = NULL, Value = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_TABLE_ITEMS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement("SELECT * FROM %s WHERE %s=%Q",
+                                       SQLITE_TABLE_ITEMS,
+                                       SQLITE_COL_OBJECTID,
+                                       *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1437,7 +1419,7 @@ int cUPnPContainerMediator::objectToDatabase(cUPnPClassObject* Object){
     if(cUPnPObjectMediator::objectToDatabase(Object)) return -1;
     cUPnPClassContainer* Container = (cUPnPClassContainer*)Object;
     cString Format = "INSERT OR REPLACE INTO %s (%s) VALUES (%s);";
-    cString Statement=NULL, Columns=NULL, Values=NULL;
+    cString Columns=NULL, Values=NULL;
     char *Value=NULL;
     cString Properties[] = {
         SQLITE_COL_OBJECTID,
@@ -1447,26 +1429,22 @@ int cUPnPContainerMediator::objectToDatabase(cUPnPClassObject* Object){
         NULL
     };
     for(cString* Property = Properties; *(*Property); Property++){
-        Columns = cString::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
+        Columns = cSQLiteDatabase::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
         if(!Container->getProperty(*Property, &Value)){
             ERROR("No such property '%s' in object with ID '%s'",*(*Property),*Container->getID());
             return -1;
         }
-        char *escapedValue;
-        escapeSQLite(Value, &escapedValue);
-        Values = cString::sprintf("%s%s'%s'", *Values?*Values:"", *Values?",":"", escapedValue?escapedValue:"NULL");
+        Values = cSQLiteDatabase::sprintf("%s%s%Q", *Values?*Values:"", *Values?",":"", Value);
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_CONTAINERS, *Columns, *Values);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_CONTAINERS, *Columns, *Values)){
         ERROR("Error while executing statement");
         return -1;
     }
     for(unsigned int i=0; i<Container->getSearchClasses()->size(); i++){
         cClass Class = Container->getSearchClasses()->at(i);
-        Columns = cString::sprintf("%s,%s,%s", SQLITE_COL_OBJECTID, SQLITE_COL_CLASS, SQLITE_COL_CLASSDERIVED);
-        Values = cString::sprintf("'%s','%s','%s'", *Container->getID(), *Class.ID, Class.includeDerived?"1":"0");
-        Statement = cString::sprintf(Format, SQLITE_TABLE_SEARCHCLASS, *Columns, *Values);
-        if(this->mDatabase->execStatement(Statement)){
+        Columns = cSQLiteDatabase::sprintf("%s,%s,%s", SQLITE_COL_OBJECTID, SQLITE_COL_CLASS, SQLITE_COL_CLASSDERIVED);
+        Values = cSQLiteDatabase::sprintf("%Q,%Q,%d", *Container->getID(), *Class.ID, Class.includeDerived?1:0);
+        if(this->mDatabase->execStatement(Format, SQLITE_TABLE_SEARCHCLASS, *Columns, *Values)){
             ERROR("Error while executing statement");
             return -1;
         }
@@ -1482,10 +1460,9 @@ int cUPnPContainerMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObje
     }
     cUPnPClassContainer* Container = (cUPnPClassContainer*)Object;
     cString Format = "SELECT * FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL;
+    cString Column = NULL, Value = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_TABLE_CONTAINERS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_CONTAINERS, SQLITE_COL_OBJECTID, *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1514,11 +1491,10 @@ int cUPnPContainerMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObje
             }
         }
     }
-    Statement = cString::sprintf("SELECT %s FROM %s WHERE %s=%s", SQLITE_COL_OBJECTID,
+    if(this->mDatabase->execStatement("SELECT %s FROM %s WHERE %s=%s", SQLITE_COL_OBJECTID,
                                                                   SQLITE_TABLE_OBJECTS,
                                                                   SQLITE_COL_PARENTID,
-                                                                  *ID);
-    if(this->mDatabase->execStatement(Statement)){
+                                                                  *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1530,8 +1506,7 @@ int cUPnPContainerMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObje
             }
         }
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_SEARCHCLASS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_SEARCHCLASS, SQLITE_COL_OBJECTID, *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1597,7 +1572,7 @@ int cUPnPVideoItemMediator::objectToDatabase(cUPnPClassObject* Object){
     if(cUPnPItemMediator::objectToDatabase(Object)) return -1;
     cUPnPClassVideoItem* VideoItem = (cUPnPClassVideoItem*)Object;
     cString Format = "INSERT OR REPLACE INTO %s (%s) VALUES (%s);";
-    cString Statement=NULL, Columns=NULL, Values=NULL;
+    cString Columns=NULL, Values=NULL;
     char *Value=NULL;
     cString Properties[] = {
         SQLITE_COL_OBJECTID,
@@ -1614,18 +1589,14 @@ int cUPnPVideoItemMediator::objectToDatabase(cUPnPClassObject* Object){
         NULL
     };
     for(cString* Property = Properties; *(*Property); Property++){
-        Columns = cString::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
+        Columns = cSQLiteDatabase::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
         if(!VideoItem->getProperty(*Property, &Value)){
             ERROR("No such property '%s' in object with ID '%s'",*(*Property),* VideoItem->getID());
             return -1;
         }
-        char *escapedValue;
-        escapeSQLite(Value, &escapedValue);
-        Values = cString::sprintf("%s%s'%s'", *Values?*Values:"", *Values?",":"", escapedValue?escapedValue:"NULL");
-        
+        Values = cSQLiteDatabase::sprintf("%s%s%Q", *Values?*Values:"", *Values?",":"", Value);
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_VIDEOITEMS, *Columns, *Values);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_VIDEOITEMS, *Columns, *Values)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1639,10 +1610,9 @@ int cUPnPVideoItemMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObje
     }
     cUPnPClassVideoItem* VideoItem = (cUPnPClassVideoItem*)Object;
     cString Format = "SELECT * FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL;
+    cString Column = NULL, Value = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_TABLE_VIDEOITEMS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_VIDEOITEMS, SQLITE_COL_OBJECTID, *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1743,7 +1713,7 @@ int cUPnPVideoBroadcastMediator::objectToDatabase(cUPnPClassObject* Object){
     if(cUPnPVideoItemMediator::objectToDatabase(Object)) return -1;
     cUPnPClassVideoBroadcast* VideoBroadcast = (cUPnPClassVideoBroadcast*)Object;
     cString Format = "INSERT OR REPLACE INTO %s (%s) VALUES (%s);";
-    cString Statement=NULL, Columns=NULL, Values=NULL;
+    cString Columns=NULL, Values=NULL;
     char *Value=NULL;
     cString Properties[] = {
         SQLITE_COL_OBJECTID,
@@ -1754,18 +1724,14 @@ int cUPnPVideoBroadcastMediator::objectToDatabase(cUPnPClassObject* Object){
         NULL
     };
     for(cString* Property = Properties; *(*Property); Property++){
-        Columns = cString::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
+        Columns = cSQLiteDatabase::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
         if(!VideoBroadcast->getProperty(*Property, &Value)){
             ERROR("No such property '%s' in object with ID '%s'",*(*Property),* VideoBroadcast->getID());
             return -1;
         }
-        char *escapedValue;
-        escapeSQLite(Value, &escapedValue);
-        Values = cString::sprintf("%s%s'%s'", *Values?*Values:"", *Values?",":"", escapedValue?escapedValue:"NULL");
-        
+        Values = cSQLiteDatabase::sprintf("%s%s%Q", *Values?*Values:"", *Values?",":"", Value);
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_VIDEOBROADCASTS, *Columns, *Values);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_VIDEOBROADCASTS, *Columns, *Values)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1779,10 +1745,9 @@ int cUPnPVideoBroadcastMediator::databaseToObject(cUPnPClassObject* Object, cUPn
     }
     cUPnPClassVideoBroadcast* VideoBroadcast = (cUPnPClassVideoBroadcast*)Object;
     cString Format = "SELECT * FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL;
+    cString Column = NULL, Value = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_TABLE_VIDEOBROADCASTS, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_VIDEOBROADCASTS, SQLITE_COL_OBJECTID, *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1847,7 +1812,7 @@ int cUPnPMovieMediator::objectToDatabase(cUPnPClassObject* Object){
     if(cUPnPVideoItemMediator::objectToDatabase(Object)) return -1;
     cUPnPClassMovie* Movie = (cUPnPClassMovie*)Object;
     cString Format = "INSERT OR REPLACE INTO %s (%s) VALUES (%s);";
-    cString Statement=NULL, Columns=NULL, Values=NULL;
+    cString Columns=NULL, Values=NULL;
     char *Value=NULL;
     cString Properties[] = {
         SQLITE_COL_OBJECTID,
@@ -1856,18 +1821,14 @@ int cUPnPMovieMediator::objectToDatabase(cUPnPClassObject* Object){
         NULL
     };
     for(cString* Property = Properties; *(*Property); Property++){
-        Columns = cString::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
+        Columns = cSQLiteDatabase::sprintf("%s%s%s", *Columns?*Columns:"", *Columns?",":"", *(*Property));
         if(!Movie->getProperty(*Property, &Value)){
             ERROR("No such property '%s' in object with ID '%s'",*(*Property),* Movie->getID());
             return -1;
         }
-        char *escapedValue;
-        escapeSQLite(Value, &escapedValue);
-        Values = cString::sprintf("%s%s'%s'", *Values?*Values:"", *Values?",":"", escapedValue?escapedValue:"NULL");
-
+        Values = cSQLiteDatabase::sprintf("%s%s%Q", *Values?*Values:"", *Values?",":"", Value);
     }
-    Statement = cString::sprintf(Format, SQLITE_TABLE_MOVIES, *Columns, *Values);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_MOVIES, *Columns, *Values)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -1881,10 +1842,9 @@ int cUPnPMovieMediator::databaseToObject(cUPnPClassObject* Object, cUPnPObjectID
     }
     cUPnPClassMovie* Movie = (cUPnPClassMovie*)Object;
     cString Format = "SELECT * FROM %s WHERE %s=%s";
-    cString Statement = NULL, Column = NULL, Value = NULL;
+    cString Column = NULL, Value = NULL;
     cRows* Rows; cRow* Row;
-    Statement = cString::sprintf(Format, SQLITE_TABLE_MOVIES, SQLITE_COL_OBJECTID, *ID);
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement(Format, SQLITE_TABLE_MOVIES, SQLITE_COL_OBJECTID, *ID)){
         ERROR("Error while executing statement");
         return -1;
     }
diff --git a/database/resources.cpp b/database/resources.cpp
index e1bfca2..7d01ceb 100644
--- a/database/resources.cpp
+++ b/database/resources.cpp
@@ -33,11 +33,7 @@ cUPnPResources* cUPnPResources::getInstance(){
 }
 
 int cUPnPResources::loadResources(){
-    cString Statement = cString::sprintf("SELECT %s FROM %s",
-                                        SQLITE_COL_RESOURCEID,
-                                        SQLITE_TABLE_RESOURCES
-                                        );
-    if(this->mDatabase->execStatement(Statement)){
+    if(this->mDatabase->execStatement("SELECT %s FROM %s",SQLITE_COL_RESOURCEID,SQLITE_TABLE_RESOURCES)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -55,13 +51,11 @@ int cUPnPResources::loadResources(){
 }
 
 int cUPnPResources::getResourcesOfObject(cUPnPClassObject* Object){
-    cString Statement = cString::sprintf("SELECT %s FROM %s WHERE %s='%s'",
+    if(this->mDatabase->execStatement("SELECT %s FROM %s WHERE %s=%Q",
                                         SQLITE_COL_RESOURCEID,
                                         SQLITE_TABLE_RESOURCES,
                                         SQLITE_COL_OBJECTID,
-                                        *Object->getID()
-                                        );
-    if(this->mDatabase->execStatement(Statement)){
+                                        *Object->getID())){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -187,12 +181,10 @@ cUPnPResourceMediator::~cUPnPResourceMediator(){}
 cUPnPResource* cUPnPResourceMediator::getResource(unsigned int ResourceID){
     cUPnPResource* Resource = new cUPnPResource;
     Resource->mResourceID = ResourceID;
-    cString Statement = cString::sprintf("SELECT * FROM %s WHERE %s=%d",
+    if(this->mDatabase->execStatement("SELECT * FROM %s WHERE %s=%d",
                                         SQLITE_TABLE_RESOURCES,
                                         SQLITE_COL_RESOURCEID,
-                                        ResourceID
-                                        );
-    if(this->mDatabase->execStatement(Statement)){
+                                        ResourceID)){
         ERROR("Error while executing statement");
         return NULL;
     }
@@ -248,42 +240,37 @@ cUPnPResource* cUPnPResourceMediator::getResource(unsigned int ResourceID){
 
 int cUPnPResourceMediator::saveResource(cUPnPResource* Resource){
 
-    char* escapedResource = NULL;
-    escapeSQLite(Resource->mResource, &escapedResource);
-
-    cString Format = "UPDATE %s SET %s WHERE %s=%d";
-    cString Sets   = cString::sprintf("%s='%s',"
-                                      "%s='%s',"
-                                      "%s='%s',"
-                                      "%s=%ld,"
-                                      "%s='%s',"
-                                      "%s=%d,"
-                                      "%s=%d,"
-                                      "%s=%d,"
-                                      "%s=%d,"
-                                      "%s=%d,"
-                                      "%s='%s',"
-                                      "%s='%s',"
-                                      "%s=%d",
-                                      SQLITE_COL_OBJECTID, *Resource->mObjectID?*Resource->mObjectID:"NULL",
-                                      SQLITE_COL_PROTOCOLINFO, *Resource->mProtocolInfo?*Resource->mProtocolInfo:"NULL",
-                                      SQLITE_COL_RESOURCE, escapedResource?escapedResource:"NULL",
-                                      SQLITE_COL_SIZE, Resource->mSize,
-                                      SQLITE_COL_DURATION, *Resource->mDuration?*Resource->mDuration:"NULL",
-                                      SQLITE_COL_BITRATE, Resource->mBitrate,
-                                      SQLITE_COL_SAMPLEFREQUENCE, Resource->mSampleFrequency,
-                                      SQLITE_COL_BITSPERSAMPLE, Resource->mBitsPerSample,
-                                      SQLITE_COL_NOAUDIOCHANNELS, Resource->mNrAudioChannels,
-                                      SQLITE_COL_COLORDEPTH, Resource->mColorDepth,
-                                      SQLITE_COL_RESOLUTION, *Resource->mResolution?*Resource->mResolution:"NULL",
-                                      SQLITE_COL_CONTENTTYPE, *Resource->mContentType,
-                                      SQLITE_COL_RESOURCETYPE, Resource->mResourceType
-                                     );
-
-    free(escapedResource);
-    cString Statement = cString::sprintf(Format, SQLITE_TABLE_RESOURCES, *Sets, SQLITE_COL_RESOURCEID, Resource->mResourceID);
-
-    if(this->mDatabase->execStatement(Statement)){
+    cString Format = "UPDATE %s SET %s=%Q,"
+                                   "%s=%Q,"
+                                   "%s=%Q,"
+                                   "%s=%ld,"
+                                   "%s=%Q,"
+                                   "%s=%d,"
+                                   "%s=%d,"
+                                   "%s=%d,"
+                                   "%s=%d,"
+                                   "%s=%d,"
+                                   "%s=%Q,"
+                                   "%s=%Q,"
+                                   "%s=%d"
+                                   " WHERE %s=%d";
+
+    if(this->mDatabase->execStatement(Format,
+                                         SQLITE_TABLE_RESOURCES,
+                                         SQLITE_COL_OBJECTID, *Resource->mObjectID,
+                                         SQLITE_COL_PROTOCOLINFO, *Resource->mProtocolInfo,
+                                         SQLITE_COL_RESOURCE, *Resource->mResource,
+                                         SQLITE_COL_SIZE, Resource->mSize,
+                                         SQLITE_COL_DURATION, *Resource->mDuration,
+                                         SQLITE_COL_BITRATE, Resource->mBitrate,
+                                         SQLITE_COL_SAMPLEFREQUENCE, Resource->mSampleFrequency,
+                                         SQLITE_COL_BITSPERSAMPLE, Resource->mBitsPerSample,
+                                         SQLITE_COL_NOAUDIOCHANNELS, Resource->mNrAudioChannels,
+                                         SQLITE_COL_COLORDEPTH, Resource->mColorDepth,
+                                         SQLITE_COL_RESOLUTION, *Resource->mResolution,
+                                         SQLITE_COL_CONTENTTYPE, *Resource->mContentType,
+                                         SQLITE_COL_RESOURCETYPE, Resource->mResourceType,
+                                         SQLITE_COL_RESOURCEID, Resource->mResourceID)){
         ERROR("Error while executing statement");
         return -1;
     }
@@ -294,9 +281,7 @@ int cUPnPResourceMediator::saveResource(cUPnPResource* Resource){
 cUPnPResource* cUPnPResourceMediator::newResource(cUPnPClassObject* Object, int ResourceType, cString ResourceFile, cString ContentType, cString ProtocolInfo){
     cUPnPResource* Resource = new cUPnPResource;
     
-    char* escapedResource = NULL;
-    
-    cString Statement = cString::sprintf("INSERT INTO %s (%s,%s,%s,%s,%s) VALUES ('%s','%s','%s','%s','%d')",
+    if(this->mDatabase->execStatement("INSERT INTO %s (%s,%s,%s,%s,%s) VALUES (%Q,%Q,%Q,%Q,%d)",
                                          SQLITE_TABLE_RESOURCES,
                                          SQLITE_COL_OBJECTID,
                                          SQLITE_COL_RESOURCE,
@@ -304,14 +289,10 @@ cUPnPResource* cUPnPResourceMediator::newResource(cUPnPClassObject* Object, int
                                          SQLITE_COL_CONTENTTYPE,
                                          SQLITE_COL_RESOURCETYPE,
                                          *Object->getID(),
-                                         escapeSQLite(ResourceFile, &escapedResource),
+                                         *ResourceFile,
                                          *ProtocolInfo,
                                          *ContentType,
-                                         ResourceType
-                                        );
-    free(escapedResource);
-    
-    if(this->mDatabase->execStatement(Statement)){
+                                         ResourceType)){
         ERROR("Error while executing statement");
         return NULL;
     }
diff --git a/receiver/livereceiver.cpp b/receiver/livereceiver.cpp
index 9ba69eb..189f4a4 100644
--- a/receiver/livereceiver.cpp
+++ b/receiver/livereceiver.cpp
@@ -129,9 +129,10 @@ int cLiveReceiver::read(char* buf, size_t buflen){
     if(!this->IsAttached())
         bytesRead = -1;
     else {
-        int WaitTimeout = RECEIVER_WAIT_ON_NODATA_TIMEOUT; // 10 Seconds timeout with no data
-        while(!this->mOutputBuffer->Available()){
-            WARNING("No data, waiting...");
+        int WaitTimeout = RECEIVER_WAIT_ON_NODATA_TIMEOUT;
+        // Wait until the buffer size is at least half the requested buffer length
+        while((unsigned)this->mOutputBuffer->Available() < (buflen / 2) ){
+            WARNING("Too few data, waiting...");
             cCondWait::SleepMs(RECEIVER_WAIT_ON_NODATA);
             if(!this->IsAttached()){
                 MESSAGE("Lost device...");
diff --git a/receiver/livereceiver.h b/receiver/livereceiver.h
index 9da8923..6b04619 100644
--- a/receiver/livereceiver.h
+++ b/receiver/livereceiver.h
@@ -12,9 +12,10 @@
 #include "filehandle.h"
 #include <vdr/thread.h>
 #include <vdr/receiver.h>
+#include <vdr/ringbuffer.h>
 
 #define RECEIVER_WAIT_ON_NODATA         50 // 50 ms
-#define RECEIVER_WAIT_ON_NODATA_TIMEOUT 1000 * 10 // 10s
+#define RECEIVER_WAIT_ON_NODATA_TIMEOUT 1000 * 2 // 2s
 
 class cLiveReceiver : public cReceiver, public cThread, public cFileHandle {
 public: