--- spo_database.h	Tue Sep 11 12:32:53 2001
+++ ../snort-1.8.1-RELEASE-mine/spo_database.h	Thu Sep  6 15:44:42 2001
@@ -101,6 +101,8 @@
     SQLHSTMT u_statement;
     SQLINTEGER  u_col;
     SQLINTEGER  u_rows;
+    SQLCHAR     u_quote_char[ 2 ];
+    SQLINTEGER  u_allocated;
 #endif
 #ifdef ENABLE_ORACLE
     OCIEnv *o_environment;
--- spo_database.c	Sun Aug 12 05:32:04 2001
+++ ../snort-1.8.1-RELEASE-mine/spo_database.c	Thu Sep  6 15:48:35 2001
@@ -591,6 +591,26 @@
     {
         tmp = GetCurrentTimestamp();
     }
+#ifdef ENABLE_ODBC
+    if(!strcasecmp(data->shared->dbtype,ODBC))
+    {
+        /*
+         * convert to ODBC timestamp format {ts 'YYYY-MM-DD HH:MM:SS.FFFF' }
+         */
+        char *ts_tmp;
+
+        if( tmp!=NULL && strlen(tmp)>=22 )
+        {
+            tmp[19] = '.';
+            tmp[23] = '\0';
+        }
+
+        ts_tmp = malloc( 64 );
+        sprintf( ts_tmp, "{ts '%s' }", tmp );
+        free( tmp );
+        tmp = ts_tmp;
+    }
+#endif
 #ifdef ENABLE_MSSQL
     if(!strcasecmp(data->shared->dbtype,MSSQL))
     {
@@ -806,10 +826,27 @@
      else
         free(select0);
 
+#ifdef ENABLE_ODBC
+    if(!strcasecmp(data->shared->dbtype,ODBC))
+    {
+        snprintf(query->val, MAX_QUERY_LENGTH,
+              "INSERT INTO event (sid,cid,signature,timestamp) VALUES "
+              "('%u', '%u', '%u', %s)",
+              data->shared->sid, data->shared->cid, sig_id, tmp);     
+    }
+    else
+    {
+        snprintf(query->val, MAX_QUERY_LENGTH,
+              "INSERT INTO event (sid,cid,signature,timestamp) VALUES "
+              "('%u', '%u', '%u', '%s')",
+              data->shared->sid, data->shared->cid, sig_id, tmp);     
+    }
+#else
      snprintf(query->val, MAX_QUERY_LENGTH,
               "INSERT INTO event (sid,cid,signature,timestamp) VALUES "
               "('%u', '%u', '%u', '%s')",
               data->shared->sid, data->shared->cid, sig_id, tmp);     
+#endif
     free(tmp); 
 
 /* We do not log fragments! They are assumed to be handled 
@@ -1165,12 +1202,12 @@
   int schema_version;
 
   select0 = (char *) malloc (MAX_QUERY_LENGTH+1);
+#ifdef ENABLE_ODBC
   snprintf(select0, MAX_QUERY_LENGTH, 
-#ifndef ENABLE_MSSQL
-           "SELECT vseq FROM schema");
+           "SELECT vseq FROM %sschema%s", data->u_quote_char, data->u_quote_char );
 #else
-           /* "schema" is a keyword in SQL Server, so quote it with square brackets */
-           "SELECT vseq FROM [schema]");
+  snprintf(select0, MAX_QUERY_LENGTH, 
+           "SELECT vseq FROM schema");
 #endif
 
   schema_version = Select(select0,data);
@@ -1245,10 +1282,14 @@
 #ifdef ENABLE_ODBC
     if(!strcasecmp(data->shared->dbtype,ODBC))
     {
-        if(SQLAllocStmt(data->u_connection, &data->u_statement) == SQL_SUCCESS)
-            if(SQLPrepare(data->u_statement, query, SQL_NTS) == SQL_SUCCESS)
-                if(SQLExecute(data->u_statement) == SQL_SUCCESS)
-                    result = 1;
+        if ( !data->u_allocated || SQLFreeStmt( data->u_statement, SQL_DROP ) == SQL_SUCCESS)
+            if(SQLAllocStmt(data->u_connection, &data->u_statement) == SQL_SUCCESS)
+                if(SQLPrepare(data->u_statement, query, SQL_NTS) == SQL_SUCCESS)
+                    if(SQLExecute(data->u_statement) == SQL_SUCCESS)
+                    {
+                        data->u_allocated = 1;
+                        result = 1;
+                    }
     }
 #endif
 
@@ -1378,25 +1419,29 @@
 #ifdef ENABLE_ODBC
     if(!strcasecmp(data->shared->dbtype,ODBC))
     {
-        if(SQLAllocStmt(data->u_connection, &data->u_statement) == SQL_SUCCESS)
-            if(SQLPrepare(data->u_statement, query, SQL_NTS) == SQL_SUCCESS)
-                if(SQLExecute(data->u_statement) == SQL_SUCCESS)
-                    if(SQLRowCount(data->u_statement, &data->u_rows) == SQL_SUCCESS)
-                        if(data->u_rows)
-                        {
-                            if(data->u_rows > 1)
-                            {
-                                ErrorMessage("database: warning (%s) returned more than one result\n", query);
-                                result = 0;
-                            }
-                            else
+        if ( !data->u_allocated || SQLFreeStmt( data->u_statement, SQL_DROP ) == SQL_SUCCESS)
+            if(SQLAllocStmt(data->u_connection, &data->u_statement) == SQL_SUCCESS)
+            {
+                data->u_allocated = 1;
+                if(SQLPrepare(data->u_statement, query, SQL_NTS) == SQL_SUCCESS)
+                    if(SQLExecute(data->u_statement) == SQL_SUCCESS)
+                        if(SQLRowCount(data->u_statement, &data->u_rows) == SQL_SUCCESS)
+                            if(data->u_rows)
                             {
-                                if(SQLFetch(data->u_statement) == SQL_SUCCESS)
-                                    if(SQLGetData(data->u_statement,1,SQL_INTEGER,&data->u_col,
-                                                  sizeof(data->u_col), NULL) == SQL_SUCCESS)
-                                        result = (int)data->u_col;
+                                if(data->u_rows > 1)
+                                {
+                                    ErrorMessage("database: warning (%s) returned more than one result\n", query);
+                                    result = 0;
+                                }
+                                else
+                                {
+                                    if(SQLFetch(data->u_statement) == SQL_SUCCESS)
+                                        if(SQLGetData(data->u_statement,1,SQL_INTEGER,&data->u_col,
+                                                      sizeof(data->u_col), NULL) == SQL_SUCCESS)
+                                            result = (int)data->u_col;
+                                }
                             }
-                        }
+            }
     }
 #endif
 
@@ -1497,6 +1542,10 @@
     }
 #endif
 
+    /*
+     * find what we can quote reserved words with
+     */
+
 #ifdef ENABLE_ODBC
     if(!strcasecmp(data->shared->dbtype,ODBC))
     {
@@ -1509,10 +1558,15 @@
         {
             FatalError("database: unable to allocate ODBC connection handle\n");
         }
-        if(!(SQLConnect(data->u_connection, data->shared->dbname, SQL_NTS, data->user, SQL_NTS, data->password, SQL_NTS) == SQL_SUCCESS))
+        if( !SQL_SUCCEEDED( (SQLConnect(data->u_connection, data->shared->dbname, SQL_NTS, data->user, SQL_NTS, data->password, SQL_NTS))))
         {
             FatalError("database: ODBC unable to connect\n");
         }
+        if( !SQL_SUCCEEDED( SQLGetInfo( data->u_connection, SQL_IDENTIFIER_QUOTE_CHAR, &data->u_quote_char, 
+                        sizeof( data->u_quote_char ), NULL )))
+        {
+            strcpy( data->u_quote_char, "" );
+        }
     }
 #endif
 
@@ -1603,7 +1657,11 @@
         {
             if(data->u_handle)
             {
+                if ( data->u_allocated )
+                    SQLFreeStmt( data->u_statement, SQL_DROP );
+                SQLEndTran(SQL_HANDLE_DBC, data->u_connection, SQL_ROLLBACK); 
                 SQLDisconnect(data->u_connection); 
+                SQLFreeHandle(SQL_HANDLE_DBC, data->u_connection); 
                 SQLFreeHandle(SQL_HANDLE_ENV, data->u_handle); 
             }
         }
