gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Escape database name in SQL query

Browse Source 
Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-07-19 09:20:15 +02:00
parent ff9291964c
commit 0fad7290c9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/server_privileges.lib.php
View File

@ -2384,7 +2384,7 @@ function PMA_getListOfPrivilegesAndComparedPrivileges()
*/
function PMA_getHtmlTableBodyForSpecificDbRoutinePrivs($db, $odd_row, $index_checkbox)
{
$sql_query = 'SELECT * FROM `mysql`.`procs_priv` WHERE Db = "' . $db . '";';
$sql_query = 'SELECT * FROM `mysql`.`procs_priv` WHERE Db = "' . Util::sqlAddSlashes($db) . '";';
$res = $GLOBALS['dbi']->query($sql_query);
$html_output = '';
while ($row = $GLOBALS['dbi']->fetchAssoc($res)) {