From d0093468d00c1aa8e6c4f524e1060100a5f5a4cb Mon Sep 17 00:00:00 2001
From: William Desportes <williamdes@wdes.fr>
Date: Mon, 15 Aug 2022 12:52:25 +0200
Subject: [PATCH] Fix escaping of SQL query and errors for debug console

Signed-off-by: William Desportes <williamdes@wdes.fr>
---
 js/src/console.js                     | 2 +-
 libraries/classes/Query/Utilities.php | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/js/src/console.js b/js/src/console.js
index 4e1c4d725f..1b1acd4e48 100644
--- a/js/src/console.js
+++ b/js/src/console.js
@@ -1364,7 +1364,7 @@ var ConsoleDebug = {
     appendQueryExtraInfo: function (query, $elem) {
         if ('error' in query) {
             $elem.append(
-                $('<div>').html(query.error)
+                $('<div>').append($('<span class="text-danger">').text(query.error))
             );
         }
         $elem.append(this.formatBackTrace(query.trace));
diff --git a/libraries/classes/Query/Utilities.php b/libraries/classes/Query/Utilities.php
index 5b9beae877..6766ecebe8 100644
--- a/libraries/classes/Query/Utilities.php
+++ b/libraries/classes/Query/Utilities.php
@@ -13,6 +13,7 @@ use function array_slice;
 use function debug_backtrace;
 use function explode;
 use function htmlspecialchars;
+use function htmlspecialchars_decode;
 use function intval;
 use function md5;
 use function sprintf;
@@ -181,11 +182,11 @@ class Utilities
         $dbgInfo = [];
 
         if ($result === false && $errorMessage !== null) {
-            $dbgInfo['error'] = '<span class="text-danger">'
-                . htmlspecialchars($errorMessage) . '</span>';
+            // because Utilities::formatError is applied in DbiMysqli
+            $dbgInfo['error'] = htmlspecialchars_decode($errorMessage);
         }
 
-        $dbgInfo['query'] = htmlspecialchars($query);
+        $dbgInfo['query'] = $query;
         $dbgInfo['time'] = $time;
         // Get and slightly format backtrace, this is used
         // in the javascript console.