gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Properly escape NavigationTreeDbSeparator in queries

Browse Source 
Signed-off-by: Michal Čihař <michal@cihar.com>
This commit is contained in:
Michal Čihař 2016-07-22 11:59:49 +02:00
parent ddeab2a11f
commit 41e3db158f
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/navigation/NavigationTree.php
View File

@ -174,7 +174,7 @@ class NavigationTree
$query = "SELECT (COUNT(DB_first_level) DIV %d) * %d ";
$query .= "from ( ";
$query .= " SELECT distinct SUBSTRING_INDEX(SCHEMA_NAME, ";
$query .= " '{$GLOBALS['cfg']['NavigationTreeDbSeparator']}', 1) ";
$query .= " '" . Util::sqlAddSlashes($GLOBALS['cfg']['NavigationTreeDbSeparator']) . "', 1) ";
$query .= " DB_first_level ";
$query .= " FROM INFORMATION_SCHEMA.SCHEMATA ";
$query .= " WHERE `SCHEMA_NAME` < '%s' ";

6
libraries/navigation/nodes/Node.php
View File

@ -434,7 +434,7 @@ class Node
$query .= "SELECT DB_first_level ";
$query .= "FROM ( ";
$query .= "SELECT DISTINCT SUBSTRING_INDEX(SCHEMA_NAME, ";
$query .= "'$dbSeparator', 1) ";
$query .= "'" . Util::sqlAddSlashes($dbSeparator) . "', 1) ";
$query .= "DB_first_level ";
$query .= "FROM INFORMATION_SCHEMA.SCHEMATA ";
$query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
@ -444,9 +444,9 @@ class Node
$query .= ") t2 ";
$query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
$query .= "AND 1 = LOCATE(CONCAT(DB_first_level, ";
$query .= "'$dbSeparator'), ";
$query .= "'" . Util::sqlAddSlashes($dbSeparator) . "'), ";
$query .= "CONCAT(SCHEMA_NAME, ";
$query .= "'$dbSeparator')) ";
$query .= "'" . Util::sqlAddSlashes($dbSeparator) . "')) ";
$query .= "ORDER BY SCHEMA_NAME ASC";
$retval = $GLOBALS['dbi']->fetchResult($query);