gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix escaping on LIKE queries

Browse Source 
All these need special variant of PMA_sqlAddSlashes.
This commit is contained in:
Michal Čihař 2011-06-27 14:50:16 +02:00
parent c9c9fdf49d
commit 12348ee826
5 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
db_printview.php
View File

@ -53,7 +53,7 @@ if ($cfg['SkipLockedTables'] == true) {
if ($result != false && PMA_DBI_num_rows($result) > 0) {
while ($tmp = PMA_DBI_fetch_row($result)) {
if (! isset($sot_cache[$tmp[0]])) {
$sts_result = PMA_DBI_query('SHOW TABLE STATUS FROM ' . PMA_backquote($db) . ' LIKE \'' . PMA_sqlAddSlashes($tmp[0]) . '\';');
$sts_result = PMA_DBI_query('SHOW TABLE STATUS FROM ' . PMA_backquote($db) . ' LIKE \'' . PMA_sqlAddSlashes($tmp[0], true) . '\';');
$sts_tmp = PMA_DBI_fetch_assoc($sts_result);
$tables[] = $sts_tmp;
} else { // table in use

2
libraries/db_info.inc.php
View File

@ -130,7 +130,7 @@ if (true === $cfg['SkipLockedTables']) {
if (! isset($sot_cache[$tmp[0]])) {
$sts_result = PMA_DBI_query(
'SHOW TABLE STATUS FROM ' . PMA_backquote($db)
. ' LIKE \'' . PMA_sqlAddSlashes($tmp[0]) . '\';');
. ' LIKE \'' . PMA_sqlAddSlashes($tmp[0], true) . '\';');
$sts_tmp = PMA_DBI_fetch_assoc($sts_result);
PMA_DBI_free_result($sts_result);
unset($sts_result);

2
libraries/export/sql.php
View File

@ -690,7 +690,7 @@ function PMA_getTableDef($db, $table, $crlf, $error_url, $show_dates = false, $a
$new_crlf = $crlf;
// need to use PMA_DBI_QUERY_STORE with PMA_DBI_num_rows() in mysqli
$result = PMA_DBI_query('SHOW TABLE STATUS FROM ' . PMA_backquote($db) . ' LIKE \'' . PMA_sqlAddSlashes($table) . '\'', null, PMA_DBI_QUERY_STORE);
$result = PMA_DBI_query('SHOW TABLE STATUS FROM ' . PMA_backquote($db) . ' LIKE \'' . PMA_sqlAddSlashes($table, true) . '\'', null, PMA_DBI_QUERY_STORE);
if ($result != false) {
if (PMA_DBI_num_rows($result) > 0) {
$tmpres = PMA_DBI_fetch_assoc($result);

6
server_privileges.php
View File

@ -166,8 +166,8 @@ function PMA_RangeOfUsers($initial = '')
// strtolower() is used because the User field
// might be BINARY, so LIKE would be case sensitive
if (!empty($initial)) {
$ret = " WHERE `User` LIKE '" . PMA_sqlAddSlashes($initial) . "%'"
. " OR `User` LIKE '" . PMA_sqlAddSlashes(strtolower($initial)) . "%'";
$ret = " WHERE `User` LIKE '" . PMA_sqlAddSlashes($initial, true) . "%'"
. " OR `User` LIKE '" . PMA_sqlAddSlashes(strtolower($initial), true) . "%'";
} else {
$ret = '';
}
@ -1888,7 +1888,7 @@ if (empty($_REQUEST['adduser']) && (! isset($checkprivs) || ! strlen($checkprivs
$user_host_condition .=
' AND `Db`'
.' LIKE \'' . PMA_sqlAddSlashes($dbname) . "'";
.' LIKE \'' . PMA_sqlAddSlashes($dbname, true) . "'";
$tables_to_search_for_users = array(
'columns_priv',

2
tbl_create.php
View File

@ -231,7 +231,7 @@ if (isset($_REQUEST['do_save_data'])) {
$is_show_stats = $cfg['ShowStats'];
$tbl_stats_result = PMA_DBI_query('SHOW TABLE STATUS FROM '
. PMA_backquote($db) . ' LIKE \'' . PMA_sqlAddSlashes($table) . '\';');
. PMA_backquote($db) . ' LIKE \'' . PMA_sqlAddSlashes($table, true) . '\';');
$tbl_stats = PMA_DBI_fetch_assoc($tbl_stats_result);
PMA_DBI_free_result($tbl_stats_result);
unset($tbl_stats_result);