Merge pull request #15492 from mauriciofauth/mysqli-prepare

Add initial suport for prepared statements

libraries/classes/DatabaseInterface.php

@@ -3156,4 +3156,17 @@ class DatabaseInterface
         $dbi = new self(new DbiMysqli());
         return $dbi;
     }
+
+    /**
+     * Prepare an SQL statement for execution.
+     *
+     * @param string $query The query, as a string.
+     * @param int    $link  Link type.
+     *
+     * @return object|false A statement object or false.
+     */
+    public function prepare(string $query, $link = DatabaseInterface::CONNECT_USER)
+    {
+        return $this->_extension->prepare($this->_links[$link], $query);
+    }
 }

libraries/classes/Dbi/DbiExtension.php

@@ -245,4 +245,14 @@ interface DbiExtension
      * @return string a MySQL escaped string
      */
     public function escapeString($link, $str);
+
+    /**
+     * Prepare an SQL statement for execution.
+     *
+     * @param mixed  $link  database link
+     * @param string $query The query, as a string.
+     *
+     * @return object|false A statement object or false.
+     */
+    public function prepare($link, string $query);
 }

libraries/classes/Dbi/DbiMysqli.php

@@ -11,6 +11,7 @@ namespace PhpMyAdmin\Dbi;
 
 use mysqli;
 use mysqli_result;
+use mysqli_stmt;
 use PhpMyAdmin\DatabaseInterface;
 use stdClass;
 use function mysqli_init;
@@ -606,4 +607,17 @@ class DbiMysqli implements DbiExtension
     {
         return $mysqli->real_escape_string($string);
     }
+
+    /**
+     * Prepare an SQL statement for execution.
+     *
+     * @param mysqli $mysqli database link
+     * @param string $query  The query, as a string.
+     *
+     * @return mysqli_stmt|false A statement object or false.
+     */
+    public function prepare($mysqli, string $query)
+    {
+        return $mysqli->prepare($query);
+    }
 }

libraries/classes/Server/Privileges.php

@@ -1516,12 +1516,21 @@ class Privileges
             SELECT `User`, `Host`, `Db`, \'t\' AS `Type`, `Table_name`, `Table_priv`
             FROM `mysql`.`tables_priv`
             WHERE
-                \'' . $this->dbi->escapeString($db) . '\' LIKE `Db` AND
-                \'' . $this->dbi->escapeString($table) . '\' LIKE `Table_name` AND
+                ? LIKE `Db` AND
+                ? LIKE `Table_name` AND
                 NOT (`Table_priv` = \'\' AND Column_priv = \'\')
             ORDER BY `User` ASC, `Host` ASC, `Db` ASC, `Table_priv` ASC;
         ';
-        $result = $this->dbi->query($query);
+        $statement = $this->dbi->prepare($query);
+        if ($statement === false
+            || ! $statement->bind_param('ss', $db, $table)
+            || ! $statement->execute()
+        ) {
+            return [];
+        }
+
+        $result = $statement->get_result();
+        $statement->close();
         if ($result === false) {
             return [];
         }

test/classes/Stubs/DbiDummy.php

@@ -452,6 +452,16 @@ class DbiDummy implements DbiExtension
         ];
     }
 
+    /**
+     * @param mixed  $link  link
+     * @param string $query query
+     * @return object|false
+     */
+    public function prepare($link, string $query)
+    {
+        return false;
+    }
+
     /**
      * Return query data for ID
      *