gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

triggers, routines, events : escape sql queries in error messages

Browse Source
This commit is contained in:
Dieter Adriaenssens 2012-10-03 20:22:25 +02:00
parent 1868a29868
commit cfd688d251
3 changed files with 80 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
libraries/rte/rte_events.lib.php
View File

@ -99,13 +99,21 @@ function PMA_EVN_handleEditor()
$drop_item = "DROP EVENT " . PMA_backquote($_REQUEST['item_original_name']) . ";\n";
$result = PMA_DBI_try_query($drop_item);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($drop_item)
)
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
} else {
$result = PMA_DBI_try_query($item_query);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($item_query)
)
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
// We dropped the old item, but were unable to create the new one
// Try to restore the backup query
$result = PMA_DBI_try_query($create_item);
@ -113,9 +121,14 @@ function PMA_EVN_handleEditor()
// OMG, this is really bad! We dropped the query, failed to create a new one
// and now even the backup query does not execute!
// This should not happen, but we better handle this just in case.
$errors[] = __('Sorry, we failed to restore the dropped event.') . '<br />'
. __('The backed up query was:') . "\"$create_item\"" . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = __(
'Sorry, we failed to restore the dropped event.'
)
. '<br />'
. __('The backed up query was:')
. "\"" . htmlspecialchars($create_item) . "\""
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
}
} else {
$message = PMA_Message::success(__('Event %1$s has been modified.'));
@ -127,8 +140,12 @@ function PMA_EVN_handleEditor()
// 'Add a new item' mode
$result = PMA_DBI_try_query($item_query);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($item_query)
)
. '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
} else {
$message = PMA_Message::success(__('Event %1$s has been created.'));
$message->addParam(PMA_backquote($_REQUEST['item_name']));

45
libraries/rte/rte_routines.lib.php
View File

@ -249,13 +249,21 @@ function PMA_RTN_handleEditor()
$drop_routine = "DROP {$_REQUEST['item_original_type']} " . PMA_backquote($_REQUEST['item_original_name']) . ";\n";
$result = PMA_DBI_try_query($drop_routine);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $drop_routine) . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($drop_routine)
)
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
} else {
$result = PMA_DBI_try_query($routine_query);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($routine_query)
)
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
// We dropped the old routine, but were unable to create the new one
// Try to restore the backup query
$result = PMA_DBI_try_query($create_routine);
@ -263,9 +271,14 @@ function PMA_RTN_handleEditor()
// OMG, this is really bad! We dropped the query, failed to create a new one
// and now even the backup query does not execute!
// This should not happen, but we better handle this just in case.
$errors[] = __('Sorry, we failed to restore the dropped routine.') . '<br />'
. __('The backed up query was:') . "\"$create_routine\"" . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = __(
'Sorry, we failed to restore the dropped routine.'
)
. '<br />'
. __('The backed up query was:')
. "\"" . htmlspecialchars($create_routine) . "\""
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
}
} else {
$message = PMA_Message::success(__('Routine %1$s has been modified.'));
@ -278,8 +291,12 @@ function PMA_RTN_handleEditor()
// 'Add a new routine' mode
$result = PMA_DBI_try_query($routine_query);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $routine_query) . '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($routine_query)
)
. '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
} else {
$message = PMA_Message::success(__('Routine %1$s has been created.'));
$message->addParam(PMA_backquote($_REQUEST['item_name']));
@ -1251,8 +1268,14 @@ function PMA_RTN_handleExecute()
}
} else {
$output = '';
$message = PMA_message::error(sprintf(__('The following query has failed: "%s"'), $query) . '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null));
$message = PMA_message::error(
sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($query)
)
. '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null)
);
}
// Print/send output
if ($GLOBALS['is_ajax_request']) {

27
libraries/rte/rte_triggers.lib.php
View File

@ -72,13 +72,21 @@ function PMA_TRI_handleEditor()
$drop_item = $trigger['drop'] . ';';
$result = PMA_DBI_try_query($drop_item);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $drop_item) . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($drop_item)
)
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
} else {
$result = PMA_DBI_try_query($item_query);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($item_query)
)
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
// We dropped the old item, but were unable to create the new one
// Try to restore the backup query
$result = PMA_DBI_try_query($create_item);
@ -86,9 +94,14 @@ function PMA_TRI_handleEditor()
// OMG, this is really bad! We dropped the query, failed to create a new one
// and now even the backup query does not execute!
// This should not happen, but we better handle this just in case.
$errors[] = __('Sorry, we failed to restore the dropped trigger.') . '<br />'
. __('The backed up query was:') . "\"$create_item\"" . '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = __(
'Sorry, we failed to restore the dropped trigger.'
)
. '<br />'
. __('The backed up query was:')
. "\"" . htmlspecialchars($create_item) . "\""
. '<br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
}
} else {
$message = PMA_Message::success(__('Trigger %1$s has been modified.'));