gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #297 from phpmyadmin/security/296

Browse Source 
SQL Injection in SearchController
This commit is contained in:
Isaac Bennetch 2020-03-20 18:21:05 -04:00 committed by GitHub
commit 155f3b2b41
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libraries/classes/Controllers/Table/TableSearchController.php
View File

@ -420,8 +420,8 @@ class TableSearchController extends TableController
public function getDataRowAction()
{
$extra_data = array();
$row_info_query = 'SELECT * FROM `' . $_POST['db'] . '`.`'
. $_POST['table'] . '` WHERE ' . $_POST['where_clause'];
$row_info_query = 'SELECT * FROM ' . Util::backquote($_POST['db']) . '.'
. Util::backquote($_POST['table']) . ' WHERE ' . $_POST['where_clause'];
$result = $this->dbi->query(
$row_info_query . ";",
DatabaseInterface::CONNECT_USER,