From ca42395ee4b2936d3702524f8fb8bec1e9502bc7 Mon Sep 17 00:00:00 2001
From: William Desportes <williamdes@wdes.fr>
Date: Fri, 28 Feb 2020 23:08:14 +0100
Subject: [PATCH] Fix #15898 - escape tbl_storage_engine argument

Signed-off-by: William Desportes <williamdes@wdes.fr>
---
 libraries/classes/CreateAddField.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/classes/CreateAddField.php b/libraries/classes/CreateAddField.php
index 1020f10c3f..88c0afffe6 100644
--- a/libraries/classes/CreateAddField.php
+++ b/libraries/classes/CreateAddField.php
@@ -467,7 +467,7 @@ class CreateAddField
         if (! empty($_POST['tbl_storage_engine'])
             && ($_POST['tbl_storage_engine'] != 'Default')
         ) {
-            $sqlQuery .= ' ENGINE = ' . $_POST['tbl_storage_engine'];
+            $sqlQuery .= ' ENGINE = ' . $this->dbi->escapeString($_POST['tbl_storage_engine']);
         }
         if (! empty($_POST['tbl_collation'])) {
             $sqlQuery .= Util::getCharsetQueryPart($_POST['tbl_collation']);