gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'QA_4_6'

Browse Source
This commit is contained in:
Michal Čihař 2016-11-10 11:08:36 +01:00
commit dad93483c1
86 changed files with 1278 additions and 1270 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -119,6 +119,7 @@ phpMyAdmin - ChangeLog
- issue #12652 Fixed visual query builder for foreign keys with more fields
- issue #12257 Improved search page performance
- issue #12322 Avoid selecting default function for foreign keys
- issue #12453 Fixed escaping of SQL parts in some corner cases
4.6.4 (2016-08-16)
- issue [security] Weaknesses with cookie encryption, see PMASA-2016-29

2
db_operations.php
View File

@ -298,7 +298,7 @@ if ($cfgRelation['pdfwork'] && $num_tables > 0) {
SELECT *
FROM ' . PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['pdf_pages']) . '
WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($GLOBALS['db'])
WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($GLOBALS['db'])
. '\'';
$test_rs = PMA_queryAsControlUser(
$test_query,

2
db_tracking.php
View File

@ -114,7 +114,7 @@ $cfgRelation = PMA_getRelationsParam();
$all_tables_query = ' SELECT table_name, MAX(version) as version FROM ' .
PMA\libraries\Util::backquote($cfgRelation['db']) . '.' .
PMA\libraries\Util::backquote($cfgRelation['tracking']) .
' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($_REQUEST['db']) .
' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['db']) .
'\' ' .
' GROUP BY table_name' .
' ORDER BY table_name ASC';

4
import.php
View File

@ -124,13 +124,13 @@ if (! empty($sql_query)) {
// making sure that :param does not apply values to :param1
$sql_query = preg_replace(
'/' . $quoted . '([^a-zA-Z0-9_])/',
PMA\libraries\Util::sqlAddSlashes($replacement) . '${1}',
$GLOBALS['dbi']->escapeString($replacement) . '${1}',
$sql_query
);
// for parameters the appear at the end of the string
$sql_query = preg_replace(
'/' . $quoted . '$/',
PMA\libraries\Util::sqlAddSlashes($replacement),
$GLOBALS['dbi']->escapeString($replacement),
$sql_query
);
}

20
libraries/Bookmark.php
View File

@ -119,10 +119,10 @@ class Bookmark
$query = "INSERT INTO " . Util::backquote($cfgBookmark['db'])
. "." . Util::backquote($cfgBookmark['table'])
. " (id, dbase, user, query, label) VALUES (NULL, "
. "'" . Util::sqlAddSlashes($this->_database) . "', "
. "'" . Util::sqlAddSlashes($this->_user) . "', "
. "'" . Util::sqlAddSlashes($this->_query) . "', "
. "'" . Util::sqlAddSlashes($this->_label) . "')";
. "'" . $GLOBALS['dbi']->escapeString($this->_database) . "', "
. "'" . $GLOBALS['dbi']->escapeString($this->_user) . "', "
. "'" . $GLOBALS['dbi']->escapeString($this->_query) . "', "
. "'" . $GLOBALS['dbi']->escapeString($this->_label) . "')";
return $GLOBALS['dbi']->query($query, $controllink);
}
@ -182,7 +182,7 @@ class Bookmark
for ($i = 1; $i <= $number_of_variables; $i++) {
$var = '';
if (! empty($variables[$i])) {
$var = Util::sqlAddSlashes($variables[$i]);
$var = $GLOBALS['dbi']->escapeString($variables[$i]);
}
$query = str_replace('[VARIABLE' . $i . ']', $var, $query);
// backward compatibility
@ -273,9 +273,9 @@ class Bookmark
$query = "SELECT * FROM " . Util::backquote($cfgBookmark['db'])
. "." . Util::backquote($cfgBookmark['table'])
. " WHERE `user` = ''"
. " OR `user` = '" . Util::sqlAddSlashes($cfgBookmark['user']) . "'";
. " OR `user` = '" . $GLOBALS['dbi']->escapeString($cfgBookmark['user']) . "'";
if ($db !== false) {
$query .= " AND dbase = '" . Util::sqlAddSlashes($db) . "'";
$query .= " AND dbase = '" . $GLOBALS['dbi']->escapeString($db) . "'";
}
$query .= " ORDER BY label";
@ -334,17 +334,17 @@ class Bookmark
$query = "SELECT * FROM " . Util::backquote($cfgBookmark['db'])
. "." . Util::backquote($cfgBookmark['table'])
. " WHERE dbase = '" . Util::sqlAddSlashes($db) . "'";
. " WHERE dbase = '" . $GLOBALS['dbi']->escapeString($db) . "'";
if (! $action_bookmark_all) {
$query .= " AND (user = '"
. Util::sqlAddSlashes($cfgBookmark['user']) . "'";
. $GLOBALS['dbi']->escapeString($cfgBookmark['user']) . "'";
if (! $exact_user_match) {
$query .= " OR user = ''";
}
$query .= ")";
}
$query .= " AND " . Util::backquote($id_field)
. " = " . Util::sqlAddSlashes($id) . " LIMIT 1";
. " = " . $GLOBALS['dbi']->escapeString($id) . " LIMIT 1";
$result = $GLOBALS['dbi']->fetchSingleRow($query, 'ASSOC', $controllink);
if (! empty($result)) {

79
libraries/DatabaseInterface.php
View File

@ -341,7 +341,7 @@ class DatabaseInterface
. implode(
'\', \'',
array_map(
'PMA\libraries\Util::sqlAddSlashes',
array($this, 'escapeString'),
$table
)
)
@ -349,13 +349,13 @@ class DatabaseInterface
} elseif (true === $tbl_is_group) {
$sql_where_table = 'AND t.`TABLE_NAME` LIKE \''
. Util::escapeMysqlWildcards(
Util::sqlAddSlashes($table)
$GLOBALS['dbi']->escapeString($table)
)
. '%\'';
} else {
$sql_where_table = 'AND t.`TABLE_NAME` '
. Util::getCollateForIS() . ' = \''
. Util::sqlAddSlashes($table) . '\'';
. $GLOBALS['dbi']->escapeString($table) . '\'';
}
} else {
$sql_where_table = '';
@ -470,7 +470,7 @@ class DatabaseInterface
// comparison (if we are looking for the db Aa we don't want
// to find the db aa)
$this_databases = array_map(
'PMA\libraries\Util::sqlAddSlashes',
array($this, 'escapeString'),
$databases
);
@ -535,14 +535,15 @@ class DatabaseInterface
. implode(
'\', \'',
array_map(
'PMA\libraries\Util::sqlAddSlashes',
$table
array($this, 'escapeString'),
$table,
$link
)
) . '\')';
} else {
$sql .= " `Name` LIKE '"
. Util::escapeMysqlWildcards(
Util::sqlAddSlashes($table, true)
$this->escapeString($table, $link)
)
. "%'";
}
@ -782,7 +783,7 @@ class DatabaseInterface
// get table information from information_schema
if (! empty($database)) {
$sql_where_schema = 'WHERE `SCHEMA_NAME` LIKE \''
. Util::sqlAddSlashes($database) . '\'';
. $this->escapeString($database, $link) . '\'';
} else {
$sql_where_schema = '';
}
@ -1017,19 +1018,19 @@ class DatabaseInterface
// get columns information from information_schema
if (null !== $database) {
$sql_wheres[] = '`TABLE_SCHEMA` = \''
. Util::sqlAddSlashes($database) . '\' ';
. $this->escapeString($database, $link) . '\' ';
} else {
$array_keys[] = 'TABLE_SCHEMA';
}
if (null !== $table) {
$sql_wheres[] = '`TABLE_NAME` = \''
. Util::sqlAddSlashes($table) . '\' ';
. $this->escapeString($table, $link) . '\' ';
} else {
$array_keys[] = 'TABLE_NAME';
}
if (null !== $column) {
$sql_wheres[] = '`COLUMN_NAME` = \''
. Util::sqlAddSlashes($column) . '\' ';
. $this->escapeString($column, $link) . '\' ';
} else {
$array_keys[] = 'COLUMN_NAME';
}
@ -1074,7 +1075,7 @@ class DatabaseInterface
$sql = 'SHOW FULL COLUMNS FROM '
. Util::backquote($database) . '.' . Util::backquote($table);
if (null !== $column) {
$sql .= " LIKE '" . Util::sqlAddSlashes($column, true) . "'";
$sql .= " LIKE '" . $this->escapeString($column, $link) . "'";
}
$columns = $this->fetchResult($sql, 'Field', null, $link);
@ -1159,7 +1160,7 @@ class DatabaseInterface
$sql = 'SHOW ' . ($full ? 'FULL' : '') . ' COLUMNS FROM '
. Util::backquote($database) . '.' . Util::backquote($table)
. (($column !== null) ? "LIKE '"
. Util::sqlAddSlashes($column, true) . "'" : '');
. $GLOBALS['dbi']->escapeString($column) . "'" : '');
return $sql;
}
@ -1399,7 +1400,7 @@ class DatabaseInterface
}
$result = $this->tryQuery(
"SET collation_connection = '"
. Util::sqlAddSlashes($GLOBALS['collation_connection'])
. $this->escapeString($GLOBALS['collation_connection'], $link)
. "';",
$link,
self::QUERY_STORE
@ -1411,7 +1412,7 @@ class DatabaseInterface
);
$this->query(
"SET collation_connection = '"
. Util::sqlAddSlashes($default_collation)
. $this->escapeString($GLOBALS['collation_connection'], $link)
. "';",
$link,
self::QUERY_STORE
@ -1795,13 +1796,13 @@ class DatabaseInterface
. " `DTD_IDENTIFIER`"
. " FROM `information_schema`.`ROUTINES`"
. " WHERE `ROUTINE_SCHEMA` " . Util::getCollateForIS()
. " = '" . Util::sqlAddSlashes($db) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($db) . "'";
if (PMA_isValid($which, array('FUNCTION','PROCEDURE'))) {
$query .= " AND `ROUTINE_TYPE` = '" . $which . "'";
}
if (! empty($name)) {
$query .= " AND `SPECIFIC_NAME`"
. " = '" . Util::sqlAddSlashes($name) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($name) . "'";
}
$result = $this->fetchResult($query);
if (!empty($result)) {
@ -1810,10 +1811,10 @@ class DatabaseInterface
} else {
if ($which == 'FUNCTION' || $which == null) {
$query = "SHOW FUNCTION STATUS"
. " WHERE `Db` = '" . Util::sqlAddSlashes($db) . "'";
. " WHERE `Db` = '" . $GLOBALS['dbi']->escapeString($db) . "'";
if (! empty($name)) {
$query .= " AND `Name` = '"
. Util::sqlAddSlashes($name) . "'";
. $GLOBALS['dbi']->escapeString($name) . "'";
}
$result = $this->fetchResult($query);
if (!empty($result)) {
@ -1822,10 +1823,10 @@ class DatabaseInterface
}
if ($which == 'PROCEDURE' || $which == null) {
$query = "SHOW PROCEDURE STATUS"
. " WHERE `Db` = '" . Util::sqlAddSlashes($db) . "'";
. " WHERE `Db` = '" . $GLOBALS['dbi']->escapeString($db) . "'";
if (! empty($name)) {
$query .= " AND `Name` = '"
. Util::sqlAddSlashes($name) . "'";
. $GLOBALS['dbi']->escapeString($name) . "'";
}
$result = $this->fetchResult($query);
if (!empty($result)) {
@ -1885,16 +1886,16 @@ class DatabaseInterface
. "`DATABASE_COLLATION` AS `Database Collation`"
. " FROM `information_schema`.`EVENTS`"
. " WHERE `EVENT_SCHEMA` " . Util::getCollateForIS()
. " = '" . Util::sqlAddSlashes($db) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($db) . "'";
if (! empty($name)) {
$query .= " AND `EVENT_NAME`"
. " = '" . Util::sqlAddSlashes($name) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($name) . "'";
}
} else {
$query = "SHOW EVENTS FROM " . Util::backquote($db);
if (! empty($name)) {
$query .= " AND `Name` = '"
. Util::sqlAddSlashes($name) . "'";
. $GLOBALS['dbi']->escapeString($name) . "'";
}
}
@ -1937,16 +1938,16 @@ class DatabaseInterface
. ', EVENT_OBJECT_SCHEMA, EVENT_OBJECT_TABLE, DEFINER'
. ' FROM information_schema.TRIGGERS'
. ' WHERE EVENT_OBJECT_SCHEMA ' . Util::getCollateForIS() . '='
. ' \'' . Util::sqlAddSlashes($db) . '\'';
. ' \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
if (! empty($table)) {
$query .= " AND EVENT_OBJECT_TABLE " . Util::getCollateForIS()
. " = '" . Util::sqlAddSlashes($table) . "';";
. " = '" . $GLOBALS['dbi']->escapeString($table) . "';";
}
} else {
$query = "SHOW TRIGGERS FROM " . Util::backquote($db);
if (! empty($table)) {
$query .= " LIKE '" . Util::sqlAddSlashes($table, true) . "';";
$query .= " LIKE '" . $GLOBALS['dbi']->escapeString($table) . "';";
}
}
@ -2669,6 +2670,27 @@ class DatabaseInterface
}
/**
* returns properly escaped string for use in MySQL queries
*
* @param string $str string to be escaped
* @param mixed $link optional database link to use
*
* @return string a MySQL escaped string
*/
public function escapeString($str, $link = null)
{
if ($link === null) {
$link = $this->getLink();
}
if ($this->_extension === null) {
return $str;
}
return $this->_extension->escapeString($link, $str);
}
/*
* Gets correct link object.
*
* @param object $link optional database link to use
@ -2684,6 +2706,7 @@ class DatabaseInterface
if (isset($GLOBALS['userlink']) && !is_null($GLOBALS['userlink'])) {
return $GLOBALS['userlink'];
} else {
error_log("YAHA\n", 3, "/tmp/a.txt");
return false;
}
}
@ -2763,7 +2786,7 @@ class DatabaseInterface
if (! $GLOBALS['cfg']['Server']['DisableIS']) {
// this is slow with thousands of databases
$sql = 'SELECT DEFAULT_COLLATION_NAME FROM information_schema.SCHEMATA'
. ' WHERE SCHEMA_NAME = \'' . Util::sqlAddSlashes($db)
. ' WHERE SCHEMA_NAME = \'' . $this->escapeString($db)
. '\' LIMIT 1';
return $this->fetchValue($sql);
} else {

7
libraries/DbSearch.php
View File

@ -142,7 +142,7 @@ class DbSearch
) {
unset($this->_criteriaColumnName);
} else {
$this->_criteriaColumnName = Util::sqlAddSlashes(
$this->_criteriaColumnName = $GLOBALS['dbi']->escapeString(
$_REQUEST['criteriaColumnName'], true
);
}
@ -206,9 +206,8 @@ class DbSearch
// For "as regular expression" (search option 4), LIKE won't be used
// Usage example: If user is searching for a literal $ in a regexp search,
// he should enter \$ as the value.
$criteriaSearchStringEscaped = Util::sqlAddSlashes(
$this->_criteriaSearchString,
($this->_criteriaSearchType == 4 ? false : true)
$criteriaSearchStringEscaped = $GLOBALS['dbi']->escapeString(
$this->_criteriaSearchString
);
// Extract search words or pattern
$search_words = (($this->_criteriaSearchType > 2)

2
libraries/DisplayResults.php
View File

@ -4054,7 +4054,7 @@ class DisplayResults
|| $bool_nowrap) ? ' nowrap' : '';
$where_comparison = ' = \''
. Util::sqlAddSlashes($column)
. $GLOBALS['dbi']->escapeString($column)
. '\'';
$cell = $this->_getRowData(

2
libraries/Menu.php
View File

@ -145,7 +145,7 @@ class Menu
. " AND `tab` LIKE '" . $level . "%'"
. " AND `usergroup` = (SELECT usergroup FROM "
. $userTable . " WHERE `username` = '"
. Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "')";
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "')";
$result = PMA_queryAsControlUser($sql_query, false);
if ($result) {

12
libraries/Partition.php
View File

@ -153,8 +153,8 @@ class Partition extends SubPartition
if (Partition::havePartitioning()) {
$result = $GLOBALS['dbi']->fetchResult(
"SELECT * FROM `information_schema`.`PARTITIONS`"
. " WHERE `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($db)
. "' AND `TABLE_NAME` = '" . Util::sqlAddSlashes($table) . "'"
. " WHERE `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($db)
. "' AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($table) . "'"
);
if ($result) {
$partitionMap = array();
@ -194,8 +194,8 @@ class Partition extends SubPartition
if (Partition::havePartitioning()) {
return $GLOBALS['dbi']->fetchResult(
"SELECT DISTINCT `PARTITION_NAME` FROM `information_schema`.`PARTITIONS`"
. " WHERE `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($db)
. "' AND `TABLE_NAME` = '" . Util::sqlAddSlashes($table) . "'"
. " WHERE `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($db)
. "' AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($table) . "'"
);
} else {
return array();
@ -215,8 +215,8 @@ class Partition extends SubPartition
if (Partition::havePartitioning()) {
$partition_method = $GLOBALS['dbi']->fetchResult(
"SELECT `PARTITION_METHOD` FROM `information_schema`.`PARTITIONS`"
. " WHERE `TABLE_SCHEMA` = '" . Util::sqlAddSlashes($db) . "'"
. " AND `TABLE_NAME` = '" . Util::sqlAddSlashes($table) . "'"
. " WHERE `TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($db) . "'"
. " AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($table) . "'"
. " LIMIT 1"
);
if (! empty($partition_method)) {

6
libraries/RecentFavoriteTable.php
View File

@ -98,7 +98,7 @@ class RecentFavoriteTable
// Read from phpMyAdmin database, if recent tables is not in session
$sql_query
= " SELECT `tables` FROM " . $this->_getPmaTable() .
" WHERE `username` = '" . Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'";
" WHERE `username` = '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'";
$return = array();
$result = PMA_queryAsControlUser($sql_query, false);
@ -121,8 +121,8 @@ class RecentFavoriteTable
$username = $GLOBALS['cfg']['Server']['user'];
$sql_query
= " REPLACE INTO " . $this->_getPmaTable() . " (`username`, `tables`)" .
" VALUES ('" . Util::sqlAddSlashes($username) . "', '"
. Util::sqlAddSlashes(
" VALUES ('" . $GLOBALS['dbi']->escapeString($username) . "', '"
. $GLOBALS['dbi']->escapeString(
json_encode($this->_tables)
) . "')";

24
libraries/SavedSearches.php
View File

@ -273,7 +273,7 @@ class SavedSearches
//If it's an insert.
if (null === $this->getId()) {
$wheres = array(
"search_name = '" . Util::sqlAddSlashes($this->getSearchName())
"search_name = '" . $GLOBALS['dbi']->escapeString($this->getSearchName())
. "'"
);
$existingSearches = $this->getList($wheres);
@ -292,10 +292,10 @@ class SavedSearches
$sqlQuery = "INSERT INTO " . $savedSearchesTbl
. "(`username`, `db_name`, `search_name`, `search_data`)"
. " VALUES ("
. "'" . Util::sqlAddSlashes($this->getUsername()) . "',"
. "'" . Util::sqlAddSlashes($this->getDbname()) . "',"
. "'" . Util::sqlAddSlashes($this->getSearchName()) . "',"
. "'" . Util::sqlAddSlashes(json_encode($this->getCriterias()))
. "'" . $GLOBALS['dbi']->escapeString($this->getUsername()) . "',"
. "'" . $GLOBALS['dbi']->escapeString($this->getDbname()) . "',"
. "'" . $GLOBALS['dbi']->escapeString($this->getSearchName()) . "',"
. "'" . $GLOBALS['dbi']->escapeString(json_encode($this->getCriterias()))
. "')";
$result = (bool)PMA_queryAsControlUser($sqlQuery);
@ -311,7 +311,7 @@ class SavedSearches
//Else, it's an update.
$wheres = array(
"id != " . $this->getId(),
"search_name = '" . Util::sqlAddSlashes($this->getSearchName()) . "'"
"search_name = '" . $GLOBALS['dbi']->escapeString($this->getSearchName()) . "'"
);
$existingSearches = $this->getList($wheres);
@ -328,9 +328,9 @@ class SavedSearches
$sqlQuery = "UPDATE " . $savedSearchesTbl
. "SET `search_name` = '"
. Util::sqlAddSlashes($this->getSearchName()) . "', "
. $GLOBALS['dbi']->escapeString($this->getSearchName()) . "', "
. "`search_data` = '"
. Util::sqlAddSlashes(json_encode($this->getCriterias())) . "' "
. $GLOBALS['dbi']->escapeString(json_encode($this->getCriterias())) . "' "
. "WHERE id = " . $this->getId();
return (bool)PMA_queryAsControlUser($sqlQuery);
}
@ -358,7 +358,7 @@ class SavedSearches
. Util::backquote($this->_config['cfgRelation']['savedsearches']);
$sqlQuery = "DELETE FROM " . $savedSearchesTbl
. "WHERE id = '" . Util::sqlAddSlashes($this->getId()) . "'";
. "WHERE id = '" . $GLOBALS['dbi']->escapeString($this->getId()) . "'";
return (bool)PMA_queryAsControlUser($sqlQuery);
}
@ -386,7 +386,7 @@ class SavedSearches
. Util::backquote($this->_config['cfgRelation']['savedsearches']);
$sqlQuery = "SELECT id, search_name, search_data "
. "FROM " . $savedSearchesTbl . " "
. "WHERE id = '" . Util::sqlAddSlashes($this->getId()) . "' ";
. "WHERE id = '" . $GLOBALS['dbi']->escapeString($this->getId()) . "' ";
$resList = PMA_queryAsControlUser($sqlQuery);
@ -426,8 +426,8 @@ class SavedSearches
$sqlQuery = "SELECT id, search_name "
. "FROM " . $savedSearchesTbl . " "
. "WHERE "
. "username = '" . Util::sqlAddSlashes($this->getUsername()) . "' "
. "AND db_name = '" . Util::sqlAddSlashes($this->getDbname()) . "' ";
. "username = '" . $GLOBALS['dbi']->escapeString($this->getUsername()) . "' "
. "AND db_name = '" . $GLOBALS['dbi']->escapeString($this->getDbname()) . "' ";
foreach ($wheres as $where) {
$sqlQuery .= "AND " . $where . " ";

4
libraries/SystemDatabase.php
View File

@ -50,7 +50,7 @@ class SystemDatabase
"SELECT * FROM %s.%s WHERE `db_name` = '%s'",
Util::backquote($cfgRelation['db']),
Util::backquote($cfgRelation['column_info']),
Util::sqlAddSlashes($db)
$GLOBALS['dbi']->escapeString($db)
);
return $this->dbi->tryQuery($pma_transformation_sql);
@ -105,7 +105,7 @@ class SystemDatabase
$data_row['comment'],
$data_row['mimetype'],
$data_row['transformation'],
Util::sqlAddSlashes(
$GLOBALS['dbi']->escapeString(
$data_row['transformation_options']
)
);

110
libraries/Table.php
View File

@ -190,8 +190,8 @@ class Table
$result = $this->_dbi->fetchResult(
"SELECT TABLE_NAME
FROM information_schema.VIEWS
WHERE TABLE_SCHEMA = '" . Util::sqlAddSlashes($db) . "'
AND TABLE_NAME = '" . Util::sqlAddSlashes($table) . "'"
WHERE TABLE_SCHEMA = '" . $GLOBALS['dbi']->escapeString($db) . "'
AND TABLE_NAME = '" . $GLOBALS['dbi']->escapeString($table) . "'"
);
return $result ? true : false;
}
@ -210,8 +210,8 @@ class Table
$result = $this->_dbi->fetchResult(
"SELECT TABLE_NAME
FROM information_schema.VIEWS
WHERE TABLE_SCHEMA = '" . Util::sqlAddSlashes($this->_db_name) . "'
AND TABLE_NAME = '" . Util::sqlAddSlashes($this->_name) . "'
WHERE TABLE_SCHEMA = '" . $GLOBALS['dbi']->escapeString($this->_db_name) . "'
AND TABLE_NAME = '" . $GLOBALS['dbi']->escapeString($this->_name) . "'
AND IS_UPDATABLE = 'YES'"
);
return $result ? true : false;
@ -408,13 +408,13 @@ class Table
} else {
// Invalid BOOLEAN value
$query .= ' DEFAULT \''
. Util::sqlAddSlashes($default_value) . '\'';
. $GLOBALS['dbi']->escapeString($default_value) . '\'';
}
} elseif ($type == 'BINARY' || $type == 'VARBINARY') {
$query .= ' DEFAULT 0x' . $default_value;
} else {
$query .= ' DEFAULT \''
. Util::sqlAddSlashes($default_value) . '\'';
. $GLOBALS['dbi']->escapeString($default_value) . '\'';
}
break;
/** @noinspection PhpMissingBreakStatementInspection */
@ -441,7 +441,7 @@ class Table
}
}
if (!empty($comment)) {
$query .= " COMMENT '" . Util::sqlAddSlashes($comment) . "'";
$query .= " COMMENT '" . $GLOBALS['dbi']->escapeString($comment) . "'";
}
// move column
@ -658,14 +658,14 @@ class Table
$where_parts = array();
foreach ($where_fields as $_where => $_value) {
$where_parts[] = Util::backquote($_where) . ' = \''
. Util::sqlAddSlashes($_value) . '\'';
. $GLOBALS['dbi']->escapeString($_value) . '\'';
}
$new_parts = array();
$new_value_parts = array();
foreach ($new_fields as $_where => $_value) {
$new_parts[] = Util::backquote($_where);
$new_value_parts[] = Util::sqlAddSlashes($_value);
$new_value_parts[] = $GLOBALS['dbi']->escapeString($_value);
}
$table_copy_query = '
@ -684,7 +684,7 @@ class Table
$value_parts = array();
foreach ($table_copy_row as $_key => $_val) {
if (isset($row_fields[$_key]) && $row_fields[$_key] == 'cc') {
$value_parts[] = Util::sqlAddSlashes($_val);
$value_parts[] = $GLOBALS['dbi']->escapeString($_val);
}
}
@ -1085,10 +1085,10 @@ class Table
. Util::backquote($GLOBALS['cfgRelation']['column_info'])
. ' WHERE '
. ' db_name = \''
. Util::sqlAddSlashes($source_db) . '\''
. $GLOBALS['dbi']->escapeString($source_db) . '\''
. ' AND '
. ' table_name = \''
. Util::sqlAddSlashes($source_table) . '\''
. $GLOBALS['dbi']->escapeString($source_table) . '\''
);
// Write every comment as new copied entry. [MIME]
@ -1103,21 +1103,21 @@ class Table
. ($GLOBALS['cfgRelation']['mimework']
? ', mimetype, transformation, transformation_options'
: '')
. ') ' . ' VALUES(' . '\'' . Util::sqlAddSlashes($target_db)
. '\',\'' . Util::sqlAddSlashes($target_table) . '\',\''
. Util::sqlAddSlashes($comments_copy_row['column_name'])
. ') ' . ' VALUES(' . '\'' . $GLOBALS['dbi']->escapeString($target_db)
. '\',\'' . $GLOBALS['dbi']->escapeString($target_table) . '\',\''
. $GLOBALS['dbi']->escapeString($comments_copy_row['column_name'])
. '\''
. ($GLOBALS['cfgRelation']['mimework']
? ',\'' . Util::sqlAddSlashes(
? ',\'' . $GLOBALS['dbi']->escapeString(
$comments_copy_row['comment']
)
. '\',' . '\'' . Util::sqlAddSlashes(
. '\',' . '\'' . $GLOBALS['dbi']->escapeString(
$comments_copy_row['mimetype']
)
. '\',' . '\'' . Util::sqlAddSlashes(
. '\',' . '\'' . $GLOBALS['dbi']->escapeString(
$comments_copy_row['transformation']
)
. '\',' . '\'' . Util::sqlAddSlashes(
. '\',' . '\'' . $GLOBALS['dbi']->escapeString(
$comments_copy_row['transformation_options']
)
. '\''
@ -1571,9 +1571,9 @@ class Table
// Read from phpMyAdmin database
$sql_query = " SELECT `prefs` FROM " . $pma_table
. " WHERE `username` = '" . Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'"
. " AND `db_name` = '" . Util::sqlAddSlashes($this->_db_name) . "'"
. " AND `table_name` = '" . Util::sqlAddSlashes($this->_name) . "'";
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'"
. " AND `db_name` = '" . $GLOBALS['dbi']->escapeString($this->_db_name) . "'"
. " AND `table_name` = '" . $GLOBALS['dbi']->escapeString($this->_name) . "'";
$row = $this->_dbi->fetchArray(PMA_queryAsControlUser($sql_query));
if (isset($row[0])) {
@ -1594,14 +1594,14 @@ class Table
$pma_table = Util::backquote($cfgRelation['db']) . "."
. Util::backquote($cfgRelation['table_uiprefs']);
$secureDbName = Util::sqlAddSlashes($this->_db_name);
$secureDbName = $GLOBALS['dbi']->escapeString($this->_db_name);
$username = $GLOBALS['cfg']['Server']['user'];
$sql_query = " REPLACE INTO " . $pma_table
. " (username, db_name, table_name, prefs) VALUES ('"
. Util::sqlAddSlashes($username) . "', '" . $secureDbName
. "', '" . Util::sqlAddSlashes($this->_name) . "', '"
. Util::sqlAddSlashes(json_encode($this->uiprefs)) . "')";
. $GLOBALS['dbi']->escapeString($username) . "', '" . $secureDbName
. "', '" . $GLOBALS['dbi']->escapeString($this->_name) . "', '"
. $GLOBALS['dbi']->escapeString(json_encode($this->uiprefs)) . "')";
$success = $this->_dbi->tryQuery($sql_query, $GLOBALS['controllink']);
@ -1968,7 +1968,7 @@ class Table
if (! empty($keyBlockSizes)) {
$sql_query .= sprintf(
' KEY_BLOCK_SIZE = ',
Util::sqlAddSlashes($keyBlockSizes)
$GLOBALS['dbi']->escapeString($keyBlockSizes)
);
}
@ -1983,14 +1983,14 @@ class Table
$parser = $index->getParser();
if ($index->getChoice() == 'FULLTEXT' && ! empty($parser)) {
$sql_query .= ' WITH PARSER ' . Util::sqlAddSlashes($parser);
$sql_query .= ' WITH PARSER ' . $GLOBALS['dbi']->escapeString($parser);
}
$comment = $index->getComment();
if (! empty($comment)) {
$sql_query .= sprintf(
" COMMENT '%s'",
Util::sqlAddSlashes($comment)
$GLOBALS['dbi']->escapeString($comment)
);
}
@ -2017,28 +2017,28 @@ class Table
. Util::backquote($GLOBALS['cfgRelation']['db'])
. '.' . Util::backquote($cfgRelation['table_info'])
. ' WHERE db_name = \''
. Util::sqlAddSlashes($this->_db_name) . '\''
. $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
. ' AND table_name = \''
. Util::sqlAddSlashes($this->_name) . '\'';
. $GLOBALS['dbi']->escapeString($this->_name) . '\'';
} elseif ($disp != $display_field) {
$upd_query = 'UPDATE '
. Util::backquote($GLOBALS['cfgRelation']['db'])
. '.' . Util::backquote($cfgRelation['table_info'])
. ' SET display_field = \''
. Util::sqlAddSlashes($display_field) . '\''
. $GLOBALS['dbi']->escapeString($display_field) . '\''
. ' WHERE db_name = \''
. Util::sqlAddSlashes($this->_db_name) . '\''
. $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
. ' AND table_name = \''
. Util::sqlAddSlashes($this->_name) . '\'';
. $GLOBALS['dbi']->escapeString($this->_name) . '\'';
}
} elseif ($display_field != '') {
$upd_query = 'INSERT INTO '
. Util::backquote($GLOBALS['cfgRelation']['db'])
. '.' . Util::backquote($cfgRelation['table_info'])
. '(db_name, table_name, display_field) VALUES('
. '\'' . Util::sqlAddSlashes($this->_db_name) . '\','
. '\'' . Util::sqlAddSlashes($this->_name) . '\','
. '\'' . Util::sqlAddSlashes($display_field) . '\')';
. '\'' . $GLOBALS['dbi']->escapeString($this->_db_name) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($this->_name) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($display_field) . '\')';
}
if ($upd_query) {
@ -2087,12 +2087,12 @@ class Table
. '(master_db, master_table, master_field, foreign_db,'
. ' foreign_table, foreign_field)'
. ' values('
. '\'' . Util::sqlAddSlashes($this->_db_name) . '\', '
. '\'' . Util::sqlAddSlashes($this->_name) . '\', '
. '\'' . Util::sqlAddSlashes($master_field) . '\', '
. '\'' . Util::sqlAddSlashes($foreign_db) . '\', '
. '\'' . Util::sqlAddSlashes($foreign_table) . '\','
. '\'' . Util::sqlAddSlashes($foreign_field) . '\')';
. '\'' . $GLOBALS['dbi']->escapeString($this->_db_name) . '\', '
. '\'' . $GLOBALS['dbi']->escapeString($this->_name) . '\', '
. '\'' . $GLOBALS['dbi']->escapeString($master_field) . '\', '
. '\'' . $GLOBALS['dbi']->escapeString($foreign_db) . '\', '
. '\'' . $GLOBALS['dbi']->escapeString($foreign_table) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($foreign_field) . '\')';
} elseif ($existrel[$master_field]['foreign_db'] != $foreign_db
|| $existrel[$master_field]['foreign_table'] != $foreign_table
@ -2102,28 +2102,28 @@ class Table
. Util::backquote($GLOBALS['cfgRelation']['db'])
. '.' . Util::backquote($cfgRelation['relation'])
. ' SET foreign_db = \''
. Util::sqlAddSlashes($foreign_db) . '\', '
. $GLOBALS['dbi']->escapeString($foreign_db) . '\', '
. ' foreign_table = \''
. Util::sqlAddSlashes($foreign_table) . '\', '
. $GLOBALS['dbi']->escapeString($foreign_table) . '\', '
. ' foreign_field = \''
. Util::sqlAddSlashes($foreign_field) . '\' '
. $GLOBALS['dbi']->escapeString($foreign_field) . '\' '
. ' WHERE master_db = \''
. Util::sqlAddSlashes($this->_db_name) . '\''
. $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
. ' AND master_table = \''
. Util::sqlAddSlashes($this->_name) . '\''
. $GLOBALS['dbi']->escapeString($this->_name) . '\''
. ' AND master_field = \''
. Util::sqlAddSlashes($master_field) . '\'';
. $GLOBALS['dbi']->escapeString($master_field) . '\'';
} // end if... else....
} elseif (isset($existrel[$master_field])) {
$upd_query = 'DELETE FROM '
. Util::backquote($GLOBALS['cfgRelation']['db'])
. '.' . Util::backquote($cfgRelation['relation'])
. ' WHERE master_db = \''
. Util::sqlAddSlashes($this->_db_name) . '\''
. $GLOBALS['dbi']->escapeString($this->_db_name) . '\''
. ' AND master_table = \''
. Util::sqlAddSlashes($this->_name) . '\''
. $GLOBALS['dbi']->escapeString($this->_name) . '\''
. ' AND master_field = \''
. Util::sqlAddSlashes($master_field) . '\'';
. $GLOBALS['dbi']->escapeString($master_field) . '\'';
} // end if... else....
if (isset($upd_query)) {
@ -2405,10 +2405,10 @@ class Table
FROM
`information_schema`.`COLUMNS`
WHERE
`TABLE_SCHEMA` = '" . Util::sqlAddSlashes($this->_db_name) . "'
AND `TABLE_NAME` = '" . Util::sqlAddSlashes($this->_name) . "'";
`TABLE_SCHEMA` = '" . $GLOBALS['dbi']->escapeString($this->_db_name) . "'
AND `TABLE_NAME` = '" . $GLOBALS['dbi']->escapeString($this->_name) . "'";
if ($column != null) {
$sql .= " AND `COLUMN_NAME` = '" . Util::sqlAddSlashes($column)
$sql .= " AND `COLUMN_NAME` = '" . $GLOBALS['dbi']->escapeString($column)
. "'";
}
$columns = $this->_dbi->fetchResult($sql, 'Field', 'Expression');

80
libraries/Tracker.php
View File

@ -123,8 +123,8 @@ class Tracker
}
$sql_query = " SELECT tracking_active FROM " . self::_getTrackingTable() .
" WHERE db_name = '" . Util::sqlAddSlashes($dbname) . "' " .
" AND table_name = '" . Util::sqlAddSlashes($tablename) . "' " .
" WHERE db_name = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
" AND table_name = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " .
" ORDER BY version DESC LIMIT 1";
$result = $GLOBALS['dbi']->fetchValue($sql_query);
@ -238,15 +238,15 @@ class Tracker
"tracking " .
") " .
"values (
'" . Util::sqlAddSlashes($dbname) . "',
'" . Util::sqlAddSlashes($tablename) . "',
'" . Util::sqlAddSlashes($version) . "',
'" . Util::sqlAddSlashes($date) . "',
'" . Util::sqlAddSlashes($date) . "',
'" . Util::sqlAddSlashes($snapshot) . "',
'" . Util::sqlAddSlashes($create_sql) . "',
'" . Util::sqlAddSlashes("\n") . "',
'" . Util::sqlAddSlashes($tracking_set)
'" . $GLOBALS['dbi']->escapeString($dbname) . "',
'" . $GLOBALS['dbi']->escapeString($tablename) . "',
'" . $GLOBALS['dbi']->escapeString($version) . "',
'" . $GLOBALS['dbi']->escapeString($date) . "',
'" . $GLOBALS['dbi']->escapeString($date) . "',
'" . $GLOBALS['dbi']->escapeString($snapshot) . "',
'" . $GLOBALS['dbi']->escapeString($create_sql) . "',
'" . $GLOBALS['dbi']->escapeString("\n") . "',
'" . $GLOBALS['dbi']->escapeString($tracking_set)
. "' )";
$result = PMA_queryAsControlUser($sql_query);
@ -276,12 +276,12 @@ class Tracker
$sql_query = "/*NOTRACK*/\n"
. "DELETE FROM " . self::_getTrackingTable()
. " WHERE `db_name` = '"
. Util::sqlAddSlashes($dbname) . "'"
. $GLOBALS['dbi']->escapeString($dbname) . "'"
. " AND `table_name` = '"
. Util::sqlAddSlashes($tablename) . "'";
. $GLOBALS['dbi']->escapeString($tablename) . "'";
if ($version) {
$sql_query .= " AND `version` = '"
. Util::sqlAddSlashes($version) . "'";
. $GLOBALS['dbi']->escapeString($version) . "'";
}
$result = PMA_queryAsControlUser($sql_query);
@ -334,15 +334,15 @@ class Tracker
"tracking " .
") " .
"values (
'" . Util::sqlAddSlashes($dbname) . "',
'" . Util::sqlAddSlashes('') . "',
'" . Util::sqlAddSlashes($version) . "',
'" . Util::sqlAddSlashes($date) . "',
'" . Util::sqlAddSlashes($date) . "',
'" . Util::sqlAddSlashes('') . "',
'" . Util::sqlAddSlashes($create_sql) . "',
'" . Util::sqlAddSlashes("\n") . "',
'" . Util::sqlAddSlashes($tracking_set)
'" . $GLOBALS['dbi']->escapeString($dbname) . "',
'" . $GLOBALS['dbi']->escapeString('') . "',
'" . $GLOBALS['dbi']->escapeString($version) . "',
'" . $GLOBALS['dbi']->escapeString($date) . "',
'" . $GLOBALS['dbi']->escapeString($date) . "',
'" . $GLOBALS['dbi']->escapeString('') . "',
'" . $GLOBALS['dbi']->escapeString($create_sql) . "',
'" . $GLOBALS['dbi']->escapeString("\n") . "',
'" . $GLOBALS['dbi']->escapeString($tracking_set)
. "' )";
$result = PMA_queryAsControlUser($sql_query);
@ -370,9 +370,9 @@ class Tracker
$sql_query = " UPDATE " . self::_getTrackingTable() .
" SET `tracking_active` = '" . $new_state . "' " .
" WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
" AND `table_name` = '" . Util::sqlAddSlashes($tablename) . "' " .
" AND `version` = '" . Util::sqlAddSlashes($version) . "' ";
" WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
" AND `table_name` = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " .
" AND `version` = '" . $GLOBALS['dbi']->escapeString($version) . "' ";
$result = PMA_queryAsControlUser($sql_query);
@ -408,7 +408,7 @@ class Tracker
if (is_array($new_data)) {
foreach ($new_data as $data) {
$new_data_processed .= '# log ' . $date . ' ' . $data['username']
. Util::sqlAddSlashes($data['statement']) . "\n";
. $GLOBALS['dbi']->escapeString($data['statement']) . "\n";
}
} else {
$new_data_processed = $new_data;
@ -416,9 +416,9 @@ class Tracker
$sql_query = " UPDATE " . self::_getTrackingTable() .
" SET `" . $save_to . "` = '" . $new_data_processed . "' " .
" WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
" AND `table_name` = '" . Util::sqlAddSlashes($tablename) . "' " .
" AND `version` = '" . Util::sqlAddSlashes($version) . "' ";
" WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
" AND `table_name` = '" . $GLOBALS['dbi']->escapeString($tablename) . "' " .
" AND `version` = '" . $GLOBALS['dbi']->escapeString($version) . "' ";
$result = PMA_queryAsControlUser($sql_query);
@ -474,8 +474,8 @@ class Tracker
static public function getVersion($dbname, $tablename, $statement = null)
{
$sql_query = " SELECT MAX(version) FROM " . self::_getTrackingTable() .
" WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
" AND `table_name` = '" . Util::sqlAddSlashes($tablename) . "' ";
" WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
" AND `table_name` = '" . $GLOBALS['dbi']->escapeString($tablename) . "' ";
if ($statement != "") {
$sql_query .= " AND FIND_IN_SET('"
@ -503,12 +503,12 @@ class Tracker
static public function getTrackedData($dbname, $tablename, $version)
{
$sql_query = " SELECT * FROM " . self::_getTrackingTable() .
" WHERE `db_name` = '" . Util::sqlAddSlashes($dbname) . "' ";
" WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' ";
if (! empty($tablename)) {
$sql_query .= " AND `table_name` = '"
. Util::sqlAddSlashes($tablename) . "' ";
. $GLOBALS['dbi']->escapeString($tablename) . "' ";
}
$sql_query .= " AND `version` = '" . Util::sqlAddSlashes($version)
$sql_query .= " AND `version` = '" . $GLOBALS['dbi']->escapeString($version)
. "' " . " ORDER BY `version` DESC LIMIT 1";
$mixed = $GLOBALS['dbi']->fetchAssoc(PMA_queryAsControlUser($sql_query));
@ -830,14 +830,14 @@ class Tracker
. " UPDATE " . self::_getTrackingTable()
. " SET " . Util::backquote($save_to)
. " = CONCAT( " . Util::backquote($save_to) . ",'\n"
. Util::sqlAddSlashes($query) . "') ,"
. $GLOBALS['dbi']->escapeString($query) . "') ,"
. " `date_updated` = '" . $date . "' ";
// If table was renamed we have to change
// the tablename attribute in pma_tracking too
if ($result['identifier'] == 'RENAME TABLE') {
$sql_query .= ', `table_name` = \''
. Util::sqlAddSlashes($result['tablename_after_rename'])
. $GLOBALS['dbi']->escapeString($result['tablename_after_rename'])
. '\' ';
}
@ -848,10 +848,10 @@ class Tracker
// we want to track
$sql_query .=
" WHERE FIND_IN_SET('" . $result['identifier'] . "',tracking) > 0" .
" AND `db_name` = '" . Util::sqlAddSlashes($dbname) . "' " .
" AND `db_name` = '" . $GLOBALS['dbi']->escapeString($dbname) . "' " .
" AND `table_name` = '"
. Util::sqlAddSlashes($result['tablename']) . "' " .
" AND `version` = '" . Util::sqlAddSlashes($version) . "' ";
. $GLOBALS['dbi']->escapeString($result['tablename']) . "' " .
" AND `version` = '" . $GLOBALS['dbi']->escapeString($version) . "' ";
PMA_queryAsControlUser($sql_query);
}

48
libraries/Util.php
View File

@ -214,46 +214,6 @@ class Util
. $max_size . '" />';
}
/**
* Add slashes before "'" and "\" characters so a value containing them can
* be used in a sql comparison.
*
* @param string $a_string the string to slash
* @param bool $is_like whether the string will be used in a 'LIKE' clause
* (it then requires two more escaped sequences) or not
* @param bool $crlf whether to treat cr/lfs as escape-worthy entities
* (converts \n to \\n, \r to \\r)
* @param bool $php_code whether this function is used as part of the
* "Create PHP code" dialog
*
* @return string the slashed string
*
* @access public
*/
public static function sqlAddSlashes(
$a_string = '',
$is_like = false,
$crlf = false,
$php_code = false
) {
if ($is_like) {
$a_string = str_replace('\\', '\\\\\\\\', $a_string);
} else {
$a_string = str_replace('\\', '\\\\', $a_string);
}
if ($crlf) {
$a_string = strtr(
$a_string,
array("\n" => '\n', "\r" => '\r', "\t" => '\t')
);
}
$a_string = str_replace('\'', '\\\'', $a_string);
return $a_string;
} // end of the 'sqlAddSlashes()' function
/**
* Add slashes before "_" and "%" characters for using them in MySQL
* database, table and field names.
@ -2259,7 +2219,7 @@ class Util
. self::printableBitValue($row[$i], $meta->length) . "'";
} else {
$con_val = '= \''
. self::sqlAddSlashes($row[$i], false, true) . '\'';
. $GLOBALS['dbi']->escapeString($row[$i]) . '\'';
}
}
@ -4006,7 +3966,7 @@ class Util
'SCHEMA_PRIVILEGES',
$username,
$priv,
self::sqlAddSlashes($db)
$GLOBALS['dbi']->escapeString($db)
)
);
if ($schema_privileges) {
@ -4029,8 +3989,8 @@ class Util
'TABLE_PRIVILEGES',
$username,
$priv,
self::sqlAddSlashes($db),
self::sqlAddSlashes($tbl)
$GLOBALS['dbi']->escapeString($db),
$GLOBALS['dbi']->escapeString($tbl)
)
);
if ($table_privileges) {

64
libraries/central_columns.lib.php
View File

@ -62,10 +62,10 @@ function PMA_getColumnsList($db, $from=0, $num=25)
//get current values of $db from central column list
if ($num == 0) {
$query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
} else {
$query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' '
. 'LIMIT ' . $from . ', ' . $num . ';';
}
$has_list = (array) $GLOBALS['dbi']->fetchResult(
@ -93,7 +93,7 @@ function PMA_getCentralColumnsCount($db)
$central_list_table = $cfgCentralColumns['table'];
$query = 'SELECT count(db_name) FROM ' .
Util::backquote($central_list_table) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
$res = $GLOBALS['dbi']->fetchResult(
$query, null, null, $GLOBALS['controllink']
);
@ -124,7 +124,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
$central_list_table = $cfgCentralColumns['table'];
if ($allFields) {
$query = 'SELECT * FROM ' . Util::backquote($central_list_table) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' AND col_name IN (' . $cols . ');';
$has_list = (array) $GLOBALS['dbi']->fetchResult(
$query, null, null, $GLOBALS['controllink']
);
@ -132,7 +132,7 @@ function PMA_findExistingColNames($db, $cols, $allFields=false)
} else {
$query = 'SELECT col_name FROM '
. Util::backquote($central_list_table) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' AND col_name IN (' . $cols . ');';
$has_list = (array) $GLOBALS['dbi']->fetchResult(
$query, null, null, $GLOBALS['controllink']
);
@ -189,14 +189,14 @@ function PMA_getInsertQuery($column, $def, $db, $central_list_table)
$default = isset($def['Default'])?$def['Default']:"";
$insQuery = 'INSERT INTO '
. Util::backquote($central_list_table) . ' '
. 'VALUES ( \'' . Util::sqlAddSlashes($db) . '\' ,'
. '\'' . Util::sqlAddSlashes($column) . '\',\''
. Util::sqlAddSlashes($type) . '\','
. '\'' . Util::sqlAddSlashes($length) . '\',\''
. Util::sqlAddSlashes($collation) . '\','
. '\'' . Util::sqlAddSlashes($isNull) . '\','
. 'VALUES ( \'' . $GLOBALS['dbi']->escapeString($db) . '\' ,'
. '\'' . $GLOBALS['dbi']->escapeString($column) . '\',\''
. $GLOBALS['dbi']->escapeString($type) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($length) . '\',\''
. $GLOBALS['dbi']->escapeString($collation) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($isNull) . '\','
. '\'' . implode(',', array($extra, $attribute))
. '\',\'' . Util::sqlAddSlashes($default) . '\');';
. '\',\'' . $GLOBALS['dbi']->escapeString($default) . '\');';
return $insQuery;
}
@ -234,7 +234,7 @@ function PMA_syncUniqueColumns($field_select, $isTable=true, $table=null)
$db, $table, null, true, $GLOBALS['userlink']
);
foreach ($fields[$table] as $field => $def) {
$cols .= "'" . Util::sqlAddSlashes($field) . "',";
$cols .= "'" . $GLOBALS['dbi']->escapeString($field) . "',";
}
}
@ -256,7 +256,7 @@ function PMA_syncUniqueColumns($field_select, $isTable=true, $table=null)
$table = $_REQUEST['table'];
}
foreach ($field_select as $column) {
$cols .= "'" . Util::sqlAddSlashes($column) . "',";
$cols .= "'" . $GLOBALS['dbi']->escapeString($column) . "',";
}
$has_list = PMA_findExistingColNames($db, trim($cols, ','));
foreach ($field_select as $column) {
@ -338,7 +338,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
$db, $table, $GLOBALS['userlink']
);
foreach ($fields[$table] as $col_select) {
$cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
$cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
}
}
$cols = trim($cols, ',');
@ -354,7 +354,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
} else {
$cols = '';
foreach ($field_select as $col_select) {
$cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
$cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
}
$cols = trim($cols, ',');
$has_list = PMA_findExistingColNames($db, $cols);
@ -378,7 +378,7 @@ function PMA_deleteColumnsFromList($field_select, $isTable=true)
$GLOBALS['dbi']->selectDb($pmadb, $GLOBALS['controllink']);
$query = 'DELETE FROM ' . Util::backquote($central_list_table) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' AND col_name IN (' . $cols . ');';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' AND col_name IN (' . $cols . ');';
if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
$message = Message::error(__('Could not remove columns!'));
@ -416,7 +416,7 @@ function PMA_makeConsistentWithList($db, $selected_tables)
//it is not referenced by another column
if ($column_status['isEditable']) {
$query .= ' MODIFY ' . Util::backquote($column['col_name']) . ' '
. Util::sqlAddSlashes($column['col_type']);
. $GLOBALS['dbi']->escapeString($column['col_type']);
if ($column['col_length']) {
$query .= '(' . $column['col_length'] . ')';
}
@ -431,11 +431,11 @@ function PMA_makeConsistentWithList($db, $selected_tables)
$query .= ' ' . $column['col_extra'];
if ($column['col_default']) {
if ($column['col_default'] != 'CURRENT_TIMESTAMP') {
$query .= ' DEFAULT \'' . Util::sqlAddSlashes(
$query .= ' DEFAULT \'' . $GLOBALS['dbi']->escapeString(
$column['col_default']
) . '\'';
} else {
$query .= ' DEFAULT ' . Util::sqlAddSlashes(
$query .= ' DEFAULT ' . $GLOBALS['dbi']->escapeString(
$column['col_default']
);
}
@ -483,7 +483,7 @@ function PMA_getCentralColumnsFromTable($db, $table, $allFields=false)
);
$cols = '';
foreach ($fields as $col_select) {
$cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
$cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
}
$cols = trim($cols, ',');
$has_list = PMA_findExistingColNames($db, $cols, $allFields);
@ -533,16 +533,16 @@ function PMA_updateOneColumn($db, $orig_col_name, $col_name, $col_type,
$query = PMA_getInsertQuery($col_name, $def, $db, $centralTable);
} else {
$query = 'UPDATE ' . Util::backquote($centralTable)
. ' SET col_type = \'' . Util::sqlAddSlashes($col_type) . '\''
. ', col_name = \'' . Util::sqlAddSlashes($col_name) . '\''
. ', col_length = \'' . Util::sqlAddSlashes($col_length) . '\''
. ' SET col_type = \'' . $GLOBALS['dbi']->escapeString($col_type) . '\''
. ', col_name = \'' . $GLOBALS['dbi']->escapeString($col_name) . '\''
. ', col_length = \'' . $GLOBALS['dbi']->escapeString($col_length) . '\''
. ', col_isNull = ' . $col_isNull
. ', col_collation = \'' . Util::sqlAddSlashes($collation) . '\''
. ', col_collation = \'' . $GLOBALS['dbi']->escapeString($collation) . '\''
. ', col_extra = \''
. implode(',', array($col_extra, $col_attribute)) . '\''
. ', col_default = \'' . Util::sqlAddSlashes($col_default) . '\''
. ' WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\' '
. 'AND col_name = \'' . Util::sqlAddSlashes($orig_col_name)
. ', col_default = \'' . $GLOBALS['dbi']->escapeString($col_default) . '\''
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\' '
. 'AND col_name = \'' . $GLOBALS['dbi']->escapeString($orig_col_name)
. '\'';
}
if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
@ -1149,7 +1149,7 @@ function PMA_getCentralColumnsListRaw($db, $table)
$centralTable = $cfgCentralColumns['table'];
if (empty($table) || $table == '') {
$query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\';';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
} else {
$GLOBALS['dbi']->selectDb($db, $GLOBALS['userlink']);
$columns = (array) $GLOBALS['dbi']->getColumnNames(
@ -1157,11 +1157,11 @@ function PMA_getCentralColumnsListRaw($db, $table)
);
$cols = '';
foreach ($columns as $col_select) {
$cols .= '\'' . Util::sqlAddSlashes($col_select) . '\',';
$cols .= '\'' . $GLOBALS['dbi']->escapeString($col_select) . '\',';
}
$cols = trim($cols, ',');
$query = 'SELECT * FROM ' . Util::backquote($centralTable) . ' '
. 'WHERE db_name = \'' . Util::sqlAddSlashes($db) . '\'';
. 'WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
if ($cols) {
$query .= ' AND col_name NOT IN (' . $cols . ')';
}
@ -1389,7 +1389,7 @@ function PMA_getHTMLforEditingPage($selected_fld,$selected_db)
$html .= PMA_getCentralColumnsEditTableHeader($header_cells);
$selected_fld_safe = array();
foreach ($selected_fld as $key) {
$selected_fld_safe[] = Util::sqlAddSlashes($key);
$selected_fld_safe[] = $GLOBALS['dbi']->escapeString($key);
}
$columns_list = implode("','", $selected_fld_safe);
$columns_list = "'" . $columns_list . "'";

2
libraries/common.inc.php
View File

@ -767,7 +767,7 @@ if (! defined('PMA_MINIMUM_COMMON')) {
if ($cfg['Server']['SessionTimeZone'] != '') {
$sql_query_tz = 'SET ' . Util::backquote('time_zone') . ' = '
. '\''
. Util::sqlAddSlashes($cfg['Server']['SessionTimeZone'])
. $GLOBALS['dbi']->escapeString($cfg['Server']['SessionTimeZone'])
. '\'';
if (! $userlink->query($sql_query_tz)) {

6
libraries/controllers/server/ServerVariablesController.php
View File

@ -135,7 +135,7 @@ class ServerVariablesController extends Controller
// when server is running in ANSI_QUOTES sql_mode
$varValue = $this->dbi->fetchSingleRow(
'SHOW GLOBAL VARIABLES WHERE Variable_name=\''
. Util::sqlAddSlashes($_REQUEST['varName']) . '\';',
. $GLOBALS['dbi']->escapeString($_REQUEST['varName']) . '\';',
'NUM'
);
@ -187,7 +187,7 @@ class ServerVariablesController extends Controller
$exp[mb_strtolower($matches[3])]
);
} else {
$value = Util::sqlAddSlashes($value);
$value = $GLOBALS['dbi']->escapeString($value);
}
if (! is_numeric($value)) {
@ -202,7 +202,7 @@ class ServerVariablesController extends Controller
// Some values are rounded down etc.
$varValue = $this->dbi->fetchSingleRow(
'SHOW GLOBAL VARIABLES WHERE Variable_name="'
. Util::sqlAddSlashes($_REQUEST['varName'])
. $GLOBALS['dbi']->escapeString($_REQUEST['varName'])
. '";', 'NUM'
);
list($formattedValue, $isHtmlFormatted) = $this->_formatVariable(

16
libraries/controllers/table/TableSearchController.php
View File

@ -647,7 +647,7 @@ class TableSearchController extends TableController
. " FROM " . Util::backquote($this->db)
. "." . Util::backquote($this->table)
. " WHERE " . Util::backquote($column)
. " RLIKE '" . Util::sqlAddSlashes($find) . "' COLLATE "
. " RLIKE '" . $GLOBALS['dbi']->escapeString($find) . "' COLLATE "
. $charSet . "_bin"; // here we
// change the collation of the 2nd operand to a case sensitive
// binary collation to make sure that the comparison is case sensitive
@ -705,13 +705,13 @@ class TableSearchController extends TableController
if (is_array($toReplace)) {
foreach ($toReplace as $row) {
$sql_query .= "\n WHEN " . Util::backquote($column)
. " = '" . Util::sqlAddSlashes($row[0])
. "' THEN '" . Util::sqlAddSlashes($row[1]) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($row[0])
. "' THEN '" . $GLOBALS['dbi']->escapeString($row[1]) . "'";
}
}
$sql_query .= " END"
. " WHERE " . Util::backquote($column)
. " RLIKE '" . Util::sqlAddSlashes($find) . "' COLLATE "
. " RLIKE '" . $GLOBALS['dbi']->escapeString($find) . "' COLLATE "
. $charSet . "_bin"; // here we
// change the collation of the 2nd operand to a case sensitive
// binary collation to make sure that the comparison
@ -965,10 +965,10 @@ class TableSearchController extends TableController
$parens_close = '';
}
$enum_where = '\''
. Util::sqlAddSlashes($criteriaValues[0]) . '\'';
. $GLOBALS['dbi']->escapeString($criteriaValues[0]) . '\'';
for ($e = 1; $e < $enum_selected_count; $e++) {
$enum_where .= ', \''
. Util::sqlAddSlashes($criteriaValues[$e]) . '\'';
. $GLOBALS['dbi']->escapeString($criteriaValues[$e]) . '\'';
}
return ' ' . $func_type . ' ' . $parens_open
@ -1094,7 +1094,7 @@ class TableSearchController extends TableController
&& 'NOT BETWEEN' != $func_type
) {
return $backquoted_name . ' ' . $func_type . ' ' . $quot
. Util::sqlAddSlashes($criteriaValues) . $quot;
. $GLOBALS['dbi']->escapeString($criteriaValues) . $quot;
}
$func_type = str_replace(' (...)', '', $func_type);
@ -1113,7 +1113,7 @@ class TableSearchController extends TableController
$value = 'NULL';
continue;
}
$value = $quot . Util::sqlAddSlashes(trim($value))
$value = $quot . $GLOBALS['dbi']->escapeString(trim($value))
. $quot;
}

4
libraries/controllers/table/TableStructureController.php
View File

@ -1208,8 +1208,8 @@ class TableStructureController extends TableController
FROM `INFORMATION_SCHEMA`.`VIEWS`
WHERE TABLE_SCHEMA='%s'
AND TABLE_NAME='%s';",
Util::sqlAddSlashes($this->db),
Util::sqlAddSlashes($this->table)
$GLOBALS['dbi']->escapeString($this->db),
$GLOBALS['dbi']->escapeString($this->table)
)
);

10
libraries/create_addfield.lib.php
View File

@ -167,7 +167,7 @@ function PMA_buildIndexStatements($index, $index_choice,
$keyBlockSizes = $index['Key_block_size'];
if (! empty($keyBlockSizes)) {
$sql_query .= " KEY_BLOCK_SIZE = "
. PMA\libraries\Util::sqlAddSlashes($keyBlockSizes);
. $GLOBALS['dbi']->escapeString($keyBlockSizes);
}
// specifying index type is allowed only for primary, unique and index only
@ -181,12 +181,12 @@ function PMA_buildIndexStatements($index, $index_choice,
$parser = $index['Parser'];
if ($index['Index_choice'] == 'FULLTEXT' && ! empty($parser)) {
$sql_query .= " WITH PARSER " . PMA\libraries\Util::sqlAddSlashes($parser);
$sql_query .= " WITH PARSER " . $GLOBALS['dbi']->escapeString($parser);
}
$comment = $index['Index_comment'];
if (! empty($comment)) {
$sql_query .= " COMMENT '" . PMA\libraries\Util::sqlAddSlashes($comment)
$sql_query .= " COMMENT '" . $GLOBALS['dbi']->escapeString($comment)
. "'";
}
@ -425,11 +425,11 @@ function PMA_getTableCreationQuery($db, $table)
&& $_REQUEST['tbl_storage_engine'] == 'FEDERATED'
) {
$sql_query .= " CONNECTION = '"
. PMA\libraries\Util::sqlAddSlashes($_REQUEST['connection']) . "'";
. $GLOBALS['dbi']->escapeString($_REQUEST['connection']) . "'";
}
if (!empty($_REQUEST['comment'])) {
$sql_query .= ' COMMENT = \''
. PMA\libraries\Util::sqlAddSlashes($_REQUEST['comment']) . '\'';
. $GLOBALS['dbi']->escapeString($_REQUEST['comment']) . '\'';
}
$sql_query .= PMA_getPartitionsDefinition();
$sql_query .= ';';

2
libraries/db_designer.lib.php
View File

@ -82,7 +82,7 @@ function PMA_getPageIdsAndNames($db)
$page_query = "SELECT `page_nr`, `page_descr` FROM "
. PMA\libraries\Util::backquote($cfgRelation['db']) . "."
. PMA\libraries\Util::backquote($cfgRelation['pdf_pages'])
. " WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($db) . "'"
. " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($db) . "'"
. " ORDER BY `page_descr`";
$page_rs = PMA_queryAsControlUser(
$page_query, false, PMA\libraries\DatabaseInterface::QUERY_STORE

2
libraries/db_table_exists.inc.php
View File

@ -63,7 +63,7 @@ if (empty($is_table)
if (! $is_table) {
$_result = $GLOBALS['dbi']->tryQuery(
'SHOW TABLES LIKE \''
. PMA\libraries\Util::sqlAddSlashes($table, true) . '\';',
. $GLOBALS['dbi']->escapeString($table) . '\';',
null, PMA\libraries\DatabaseInterface::QUERY_STORE
);
$is_table = @$GLOBALS['dbi']->numRows($_result);

13
libraries/dbi/DBIDummy.php
View File

@ -1253,4 +1253,17 @@ class DBIDummy implements DBIExtension
{
return '';
}
/**
* returns properly escaped string for use in MySQL queries
*
* @param mixed $link database link
* @param string $str string to be escaped
*
* @return string a MySQL escaped string
*/
public function escapeString($link, $str)
{
return $str;
}
}

10
libraries/dbi/DBIExtension.php
View File

@ -231,4 +231,14 @@ interface DBIExtension
* @return string field flags
*/
public function fieldFlags($result, $i);
/**
* returns properly escaped string for use in MySQL queries
*
* @param mixed $link database link
* @param string $str string to be escaped
*
* @return string a MySQL escaped string
*/
public function escapeString($link, $str);
}

13
libraries/dbi/DBIMysql.php
View File

@ -447,4 +447,17 @@ class DBIMysql implements DBIExtension
{
return false;
}
/**
* returns properly escaped string for use in MySQL queries
*
* @param mixed $link database link
* @param string $str string to be escaped
*
* @return string a MySQL escaped string
*/
public function escapeString($link, $str)
{
return mysql_real_escape_string($str, $link);
}
}

13
libraries/dbi/DBIMysqli.php
View File

@ -578,4 +578,17 @@ class DBIMysqli implements DBIExtension
}
return implode(' ', $flags);
}
/**
* returns properly escaped string for use in MySQL queries
*
* @param mixed $link database link
* @param string $str string to be escaped
*
* @return string a MySQL escaped string
*/
public function escapeString($link, $str)
{
return mysqli_real_escape_string($link, $str);
}
}

16
libraries/display_export.lib.php
View File

@ -251,8 +251,8 @@ function PMA_getOptionsForExportTemplates($export_type)
. PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['export_templates'])
. " WHERE `username` = "
. "'" . PMA\libraries\Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user'])
. "' AND `export_type` = '" . PMA\libraries\Util::sqlAddSlashes($export_type) . "'"
. "'" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user'])
. "' AND `export_type` = '" . $GLOBALS['dbi']->escapeString($export_type) . "'"
. " ORDER BY `template_name`;";
$result = PMA_queryAsControlUser($query);
@ -1111,14 +1111,14 @@ function PMA_getExportDisplay(
function PMA_handleExportTemplateActions($cfgRelation)
{
if (isset($_REQUEST['templateId'])) {
$id = PMA\libraries\Util::sqlAddSlashes($_REQUEST['templateId']);
$id = $GLOBALS['dbi']->escapeString($_REQUEST['templateId']);
} else {
$id = '';
}
$templateTable = PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['export_templates']);
$user = PMA\libraries\Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']);
$user = $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']);
switch ($_REQUEST['templateAction']) {
case 'create':
@ -1127,9 +1127,9 @@ function PMA_handleExportTemplateActions($cfgRelation)
. " `template_name`, `template_data`"
. ") VALUES ("
. "'" . $user . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['exportType'])
. "', '" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['templateName'])
. "', '" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['templateData'])
. "'" . $GLOBALS['dbi']->escapeString($_REQUEST['exportType'])
. "', '" . $GLOBALS['dbi']->escapeString($_REQUEST['templateName'])
. "', '" . $GLOBALS['dbi']->escapeString($_REQUEST['templateData'])
. "');";
break;
case 'load':
@ -1138,7 +1138,7 @@ function PMA_handleExportTemplateActions($cfgRelation)
break;
case 'update':
$query = "UPDATE " . $templateTable . " SET `template_data` = "
. "'" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['templateData']) . "'"
. "'" . $GLOBALS['dbi']->escapeString($_REQUEST['templateData']) . "'"
. " WHERE `id` = " . $id . " AND `username` = '" . $user . "'";
break;
case 'delete':

4
libraries/export.lib.php
View File

@ -659,8 +659,8 @@ function PMA_exportDatabase(
// This obtains the current table's size
$query = 'SELECT data_length + index_length
from information_schema.TABLES
WHERE table_schema = "' . PMA\libraries\Util::sqlAddSlashes($db) . '"
AND table_name = "' . PMA\libraries\Util::sqlAddSlashes($table) . '"';
WHERE table_schema = "' . $GLOBALS['dbi']->escapeString($db) . '"
AND table_name = "' . $GLOBALS['dbi']->escapeString($table) . '"';
$size = $GLOBALS['dbi']->fetchValue($query);
//Converting the size to MB

2
libraries/import.lib.php
View File

@ -1109,7 +1109,7 @@ function PMA_buildSQL($db_name, &$tables, &$analyses = null,
}
$tempSQLStr .= (($is_varchar) ? "'" : "");
$tempSQLStr .= PMA\libraries\Util::sqlAddSlashes(
$tempSQLStr .= $GLOBALS['dbi']->escapeString(
(string) $tables[$i][ROWS][$j][$k]
);
$tempSQLStr .= (($is_varchar) ? "'" : "");

12
libraries/insert_edit.lib.php
View File

@ -2259,7 +2259,7 @@ function PMA_getCurrentValueAsAnArrayForMultipleEdit( $multi_edit_funcs,
|| $multi_edit_funcs[$key] == "ENCRYPT"))
) {
return $multi_edit_funcs[$key] . '(' . $current_value . ",'"
. PMA\libraries\Util::sqlAddSlashes($multi_edit_salt[$key]) . "')";
. $GLOBALS['dbi']->escapeString($multi_edit_salt[$key]) . "')";
} else {
return $multi_edit_funcs[$key] . '(' . $current_value . ')';
}
@ -2318,7 +2318,7 @@ function PMA_getQueryValuesForInsertAndUpdateInMultipleEdit($multi_edit_columns_
. ' = ' . $current_value_as_an_array;
} elseif (empty($multi_edit_funcs[$key])
&& isset($multi_edit_columns_prev[$key])
&& (("'" . PMA\libraries\Util::sqlAddSlashes($multi_edit_columns_prev[$key]) . "'" === $current_value)
&& (("'" . $GLOBALS['dbi']->escapeString($multi_edit_columns_prev[$key]) . "'" === $current_value)
|| ('0x' . $multi_edit_columns_prev[$key] === $current_value))
) {
// No change for this column and no MySQL function is used -> next column
@ -2377,7 +2377,7 @@ function PMA_getCurrentValueForDifferentTypes($possibly_uploaded_val, $key,
if (false !== $possibly_uploaded_val) {
$current_value = $possibly_uploaded_val;
} else if (! empty($multi_edit_funcs[$key])) {
$current_value = "'" . PMA\libraries\Util::sqlAddSlashes($current_value)
$current_value = "'" . $GLOBALS['dbi']->escapeString($current_value)
. "'";
} else {
// c o l u m n v a l u e i n t h e f o r m
@ -2403,7 +2403,7 @@ function PMA_getCurrentValueForDifferentTypes($possibly_uploaded_val, $key,
',', $_REQUEST['fields']['multi_edit'][$rownumber][$key]
);
$current_value = "'"
. PMA\libraries\Util::sqlAddSlashes($current_value) . "'";
. $GLOBALS['dbi']->escapeString($current_value) . "'";
} else {
$current_value = "''";
}
@ -2426,12 +2426,12 @@ function PMA_getCurrentValueForDifferentTypes($possibly_uploaded_val, $key,
$current_value = '0x' . $current_value;
} elseif ($type == 'bit') {
$current_value = preg_replace('/[^01]/', '0', $current_value);
$current_value = "b'" . PMA\libraries\Util::sqlAddSlashes($current_value)
$current_value = "b'" . $GLOBALS['dbi']->escapeString($current_value)
. "'";
} elseif (! ($type == 'datetime' || $type == 'timestamp')
|| $current_value != 'CURRENT_TIMESTAMP'
) {
$current_value = "'" . PMA\libraries\Util::sqlAddSlashes($current_value)
$current_value = "'" . $GLOBALS['dbi']->escapeString($current_value)
. "'";
}

26
libraries/navigation/Navigation.php
View File

@ -91,11 +91,11 @@ class Navigation
$sqlQuery = "INSERT INTO " . $navTable
. "(`username`, `item_name`, `item_type`, `db_name`, `table_name`)"
. " VALUES ("
. "'" . Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "',"
. "'" . Util::sqlAddSlashes($itemName) . "',"
. "'" . Util::sqlAddSlashes($itemType) . "',"
. "'" . Util::sqlAddSlashes($dbName) . "',"
. "'" . (! empty($tableName)? Util::sqlAddSlashes($tableName) : "" )
. "'" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "',"
. "'" . $GLOBALS['dbi']->escapeString($itemName) . "',"
. "'" . $GLOBALS['dbi']->escapeString($itemType) . "',"
. "'" . $GLOBALS['dbi']->escapeString($dbName) . "',"
. "'" . (! empty($tableName)? $GLOBALS['dbi']->escapeString($tableName) : "" )
. "')";
PMA_queryAsControlUser($sqlQuery, false);
}
@ -140,12 +140,12 @@ class Navigation
$sqlQuery = "DELETE FROM " . $navTable
. " WHERE"
. " `username`='"
. Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'"
. " AND `item_name`='" . Util::sqlAddSlashes($itemName) . "'"
. " AND `item_type`='" . Util::sqlAddSlashes($itemType) . "'"
. " AND `db_name`='" . Util::sqlAddSlashes($dbName) . "'"
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'"
. " AND `item_name`='" . $GLOBALS['dbi']->escapeString($itemName) . "'"
. " AND `item_type`='" . $GLOBALS['dbi']->escapeString($itemType) . "'"
. " AND `db_name`='" . $GLOBALS['dbi']->escapeString($dbName) . "'"
. (! empty($tableName)
? " AND `table_name`='" . Util::sqlAddSlashes($tableName) . "'"
? " AND `table_name`='" . $GLOBALS['dbi']->escapeString($tableName) . "'"
: ""
);
PMA_queryAsControlUser($sqlQuery, false);
@ -170,10 +170,10 @@ class Navigation
. "." . Util::backquote($GLOBALS['cfgRelation']['navigationhiding']);
$sqlQuery = "SELECT `item_name`, `item_type` FROM " . $navTable
. " WHERE `username`='"
. Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'"
. " AND `db_name`='" . Util::sqlAddSlashes($dbName) . "'"
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['user']) . "'"
. " AND `db_name`='" . $GLOBALS['dbi']->escapeString($dbName) . "'"
. " AND `table_name`='"
. (! empty($tableName) ? Util::sqlAddSlashes($tableName) : '') . "'";
. (! empty($tableName) ? $GLOBALS['dbi']->escapeString($tableName) : '') . "'";
$result = PMA_queryAsControlUser($sqlQuery, false);
$hidden = array();

4
libraries/navigation/NavigationTree.php
View File

@ -175,7 +175,7 @@ class NavigationTree
$query = "SELECT (COUNT(DB_first_level) DIV %d) * %d ";
$query .= "from ( ";
$query .= " SELECT distinct SUBSTRING_INDEX(SCHEMA_NAME, ";
$query .= " '" . Util::sqlAddSlashes($GLOBALS['cfg']['NavigationTreeDbSeparator']) . "', 1) ";
$query .= " '" . $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['NavigationTreeDbSeparator']) . "', 1) ";
$query .= " DB_first_level ";
$query .= " FROM INFORMATION_SCHEMA.SCHEMATA ";
$query .= " WHERE `SCHEMA_NAME` < '%s' ";
@ -186,7 +186,7 @@ class NavigationTree
$query,
(int)$GLOBALS['cfg']['FirstLevelNavigationItems'],
(int)$GLOBALS['cfg']['FirstLevelNavigationItems'],
Util::sqlAddSlashes($GLOBALS['db'])
$GLOBALS['dbi']->escapeString($GLOBALS['db'])
)
);

18
libraries/navigation/nodes/Node.php
View File

@ -434,7 +434,7 @@ class Node
$query .= "SELECT DB_first_level ";
$query .= "FROM ( ";
$query .= "SELECT DISTINCT SUBSTRING_INDEX(SCHEMA_NAME, ";
$query .= "'" . Util::sqlAddSlashes($dbSeparator) . "', 1) ";
$query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "', 1) ";
$query .= "DB_first_level ";
$query .= "FROM INFORMATION_SCHEMA.SCHEMATA ";
$query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
@ -444,9 +444,9 @@ class Node
$query .= ") t2 ";
$query .= $this->_getWhereClause('SCHEMA_NAME', $searchClause);
$query .= "AND 1 = LOCATE(CONCAT(DB_first_level, ";
$query .= "'" . Util::sqlAddSlashes($dbSeparator) . "'), ";
$query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "'), ";
$query .= "CONCAT(SCHEMA_NAME, ";
$query .= "'" . Util::sqlAddSlashes($dbSeparator) . "')) ";
$query .= "'" . $GLOBALS['dbi']->escapeString($dbSeparator) . "')) ";
$query .= "ORDER BY SCHEMA_NAME ASC";
$retval = $GLOBALS['dbi']->fetchResult($query);
@ -480,7 +480,7 @@ class Node
$subClauses = array();
foreach ($prefixes as $prefix) {
$subClauses[] = " LOCATE('"
. Util::sqlAddSlashes($prefix) . $dbSeparator
. $GLOBALS['dbi']->escapeString($prefix) . $dbSeparator
. "', "
. "CONCAT(`Database`, '" . $dbSeparator . "')) = 1 ";
}
@ -685,7 +685,7 @@ class Node
{
if (!empty($searchClause)) {
$databases = array(
"%" . Util::sqlAddSlashes($searchClause, true) . "%",
"%" . $GLOBALS['dbi']->escapeString($searchClause, true) . "%",
);
} elseif (!empty($GLOBALS['cfg']['Server']['only_db'])) {
$databases = $GLOBALS['cfg']['Server']['only_db'];
@ -712,7 +712,7 @@ class Node
if (!empty($searchClause)) {
$whereClause .= "AND " . Util::backquote($columnName)
. " LIKE '%";
$whereClause .= Util::sqlAddSlashes(
$whereClause .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
@ -722,7 +722,7 @@ class Node
if (!empty($GLOBALS['cfg']['Server']['hide_db'])) {
$whereClause .= "AND " . Util::backquote($columnName)
. " NOT REGEXP '"
. Util::sqlAddSlashes($GLOBALS['cfg']['Server']['hide_db'], true)
. $GLOBALS['dbi']->escapeString($GLOBALS['cfg']['Server']['hide_db'], true)
. "' ";
}
@ -737,7 +737,7 @@ class Node
foreach ($GLOBALS['cfg']['Server']['only_db'] as $each_only_db) {
$subClauses[] = " " . Util::backquote($columnName)
. " LIKE '"
. Util::sqlAddSlashes($each_only_db, true) . "' ";
. $GLOBALS['dbi']->escapeString($each_only_db, true) . "' ";
}
$whereClause .= implode("OR", $subClauses) . ") ";
}
@ -817,7 +817,7 @@ class Node
);
$sqlQuery = "SELECT `db_name`, COUNT(*) AS `count` FROM " . $navTable
. " WHERE `username`='"
. Util::sqlAddSlashes(
. $GLOBALS['dbi']->escapeString(
$GLOBALS['cfg']['Server']['user']
) . "'"
. " GROUP BY `db_name`";

38
libraries/navigation/nodes/NodeDatabase.php
View File

@ -116,7 +116,7 @@ class NodeDatabase extends Node
}
if (! $GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$db = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT COUNT(*) ";
$query .= "FROM `INFORMATION_SCHEMA`.`TABLES` ";
$query .= "WHERE `TABLE_SCHEMA`='$db' ";
@ -200,7 +200,7 @@ class NodeDatabase extends Node
{
$db = $this->real_name;
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$db = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT COUNT(*) ";
$query .= "FROM `INFORMATION_SCHEMA`.`ROUTINES` ";
$query .= "WHERE `ROUTINE_SCHEMA` "
@ -215,7 +215,7 @@ class NodeDatabase extends Node
}
$retval = (int)$GLOBALS['dbi']->fetchValue($query);
} else {
$db = Util::sqlAddSlashes($db);
$db = $GLOBALS['dbi']->escapeString($db);
$query = "SHOW PROCEDURE STATUS WHERE `Db`='$db' ";
if (!empty($searchClause)) {
$query .= "AND " . $this->_getWhereClauseForSearch(
@ -246,7 +246,7 @@ class NodeDatabase extends Node
{
$db = $this->real_name;
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$db = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT COUNT(*) ";
$query .= "FROM `INFORMATION_SCHEMA`.`ROUTINES` ";
$query .= "WHERE `ROUTINE_SCHEMA` "
@ -261,7 +261,7 @@ class NodeDatabase extends Node
}
$retval = (int)$GLOBALS['dbi']->fetchValue($query);
} else {
$db = Util::sqlAddSlashes($db);
$db = $GLOBALS['dbi']->escapeString($db);
$query = "SHOW FUNCTION STATUS WHERE `Db`='$db' ";
if (!empty($searchClause)) {
$query .= "AND " . $this->_getWhereClauseForSearch(
@ -292,7 +292,7 @@ class NodeDatabase extends Node
{
$db = $this->real_name;
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$db = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT COUNT(*) ";
$query .= "FROM `INFORMATION_SCHEMA`.`EVENTS` ";
$query .= "WHERE `EVENT_SCHEMA` "
@ -340,10 +340,10 @@ class NodeDatabase extends Node
$query = '';
if ($singleItem) {
$query .= Util::backquote($columnName) . " = ";
$query .= "'" . Util::sqlAddSlashes($searchClause) . "'";
$query .= "'" . $GLOBALS['dbi']->escapeString($searchClause) . "'";
} else {
$query .= Util::backquote($columnName) . " LIKE ";
$query .= "'%" . Util::sqlAddSlashes($searchClause, true)
$query .= "'%" . $GLOBALS['dbi']->escapeString($searchClause, true)
. "%'";
}
@ -419,7 +419,7 @@ class NodeDatabase extends Node
$sqlQuery = "SELECT `item_name` FROM " . $navTable
. " WHERE `username`='" . $cfgRelation['user'] . "'"
. " AND `item_type`='" . $type
. "'" . " AND `db_name`='" . Util::sqlAddSlashes($db)
. "'" . " AND `db_name`='" . $GLOBALS['dbi']->escapeString($db)
. "'";
$result = PMA_queryAsControlUser($sqlQuery, false);
$hiddenItems = array();
@ -453,14 +453,14 @@ class NodeDatabase extends Node
$retval = array();
$db = $this->real_name;
if (! $GLOBALS['cfg']['Server']['DisableIS']) {
$escdDb = Util::sqlAddSlashes($db);
$escdDb = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT `TABLE_NAME` AS `name` ";
$query .= "FROM `INFORMATION_SCHEMA`.`TABLES` ";
$query .= "WHERE `TABLE_SCHEMA`='$escdDb' ";
$query .= "AND `TABLE_TYPE`" . $condition . "'BASE TABLE' ";
if (! empty($searchClause)) {
$query .= "AND `TABLE_NAME` LIKE '%";
$query .= Util::sqlAddSlashes(
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
@ -477,7 +477,7 @@ class NodeDatabase extends Node
$query .= "AND " . Util::backquote(
"Tables_in_" . $db
);
$query .= " LIKE '%" . Util::sqlAddSlashes(
$query .= " LIKE '%" . $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
@ -543,7 +543,7 @@ class NodeDatabase extends Node
$retval = array();
$db = $this->real_name;
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$escdDb = Util::sqlAddSlashes($db);
$escdDb = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT `ROUTINE_NAME` AS `name` ";
$query .= "FROM `INFORMATION_SCHEMA`.`ROUTINES` ";
$query .= "WHERE `ROUTINE_SCHEMA` "
@ -551,7 +551,7 @@ class NodeDatabase extends Node
$query .= "AND `ROUTINE_TYPE`='" . $routineType . "' ";
if (!empty($searchClause)) {
$query .= "AND `ROUTINE_NAME` LIKE '%";
$query .= Util::sqlAddSlashes(
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
@ -561,11 +561,11 @@ class NodeDatabase extends Node
$query .= "LIMIT " . intval($pos) . ", $maxItems";
$retval = $GLOBALS['dbi']->fetchResult($query);
} else {
$escdDb = Util::sqlAddSlashes($db);
$escdDb = $GLOBALS['dbi']->escapeString($db);
$query = "SHOW " . $routineType . " STATUS WHERE `Db`='$escdDb' ";
if (!empty($searchClause)) {
$query .= "AND `Name` LIKE '%";
$query .= Util::sqlAddSlashes(
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
@ -630,14 +630,14 @@ class NodeDatabase extends Node
$retval = array();
$db = $this->real_name;
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$escdDb = Util::sqlAddSlashes($db);
$escdDb = $GLOBALS['dbi']->escapeString($db);
$query = "SELECT `EVENT_NAME` AS `name` ";
$query .= "FROM `INFORMATION_SCHEMA`.`EVENTS` ";
$query .= "WHERE `EVENT_SCHEMA` "
. Util::getCollateForIS() . "='$escdDb' ";
if (!empty($searchClause)) {
$query .= "AND `EVENT_NAME` LIKE '%";
$query .= Util::sqlAddSlashes(
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);
@ -651,7 +651,7 @@ class NodeDatabase extends Node
$query = "SHOW EVENTS FROM $escdDb ";
if (!empty($searchClause)) {
$query .= "WHERE `Name` LIKE '%";
$query .= Util::sqlAddSlashes(
$query .= $GLOBALS['dbi']->escapeString(
$searchClause,
true
);

20
libraries/navigation/nodes/NodeTable.php
View File

@ -92,8 +92,8 @@ class NodeTable extends NodeDatabaseChild
switch ($type) {
case 'columns':
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$table = Util::sqlAddSlashes($table);
$db = $GLOBALS['dbi']->escapeString($db);
$table = $GLOBALS['dbi']->escapeString($table);
$query = "SELECT COUNT(*) ";
$query .= "FROM `INFORMATION_SCHEMA`.`COLUMNS` ";
$query .= "WHERE `TABLE_NAME`='$table' ";
@ -118,8 +118,8 @@ class NodeTable extends NodeDatabaseChild
break;
case 'triggers':
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$table = Util::sqlAddSlashes($table);
$db = $GLOBALS['dbi']->escapeString($db);
$table = $GLOBALS['dbi']->escapeString($table);
$query = "SELECT COUNT(*) ";
$query .= "FROM `INFORMATION_SCHEMA`.`TRIGGERS` ";
$query .= "WHERE `EVENT_OBJECT_SCHEMA` "
@ -129,7 +129,7 @@ class NodeTable extends NodeDatabaseChild
$retval = (int)$GLOBALS['dbi']->fetchValue($query);
} else {
$db = Util::backquote($db);
$table = Util::sqlAddSlashes($table);
$table = $GLOBALS['dbi']->escapeString($table);
$query = "SHOW TRIGGERS FROM $db WHERE `Table` = '$table'";
$retval = (int)$GLOBALS['dbi']->numRows(
$GLOBALS['dbi']->tryQuery($query)
@ -164,8 +164,8 @@ class NodeTable extends NodeDatabaseChild
switch ($type) {
case 'columns':
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$table = Util::sqlAddSlashes($table);
$db = $GLOBALS['dbi']->escapeString($db);
$table = $GLOBALS['dbi']->escapeString($table);
$query = "SELECT `COLUMN_NAME` AS `name` ";
$query .= "FROM `INFORMATION_SCHEMA`.`COLUMNS` ";
$query .= "WHERE `TABLE_NAME`='$table' ";
@ -219,8 +219,8 @@ class NodeTable extends NodeDatabaseChild
break;
case 'triggers':
if (!$GLOBALS['cfg']['Server']['DisableIS']) {
$db = Util::sqlAddSlashes($db);
$table = Util::sqlAddSlashes($table);
$db = $GLOBALS['dbi']->escapeString($db);
$table = $GLOBALS['dbi']->escapeString($table);
$query = "SELECT `TRIGGER_NAME` AS `name` ";
$query .= "FROM `INFORMATION_SCHEMA`.`TRIGGERS` ";
$query .= "WHERE `EVENT_OBJECT_SCHEMA` "
@ -234,7 +234,7 @@ class NodeTable extends NodeDatabaseChild
}
$db = Util::backquote($db);
$table = Util::sqlAddSlashes($table);
$table = $GLOBALS['dbi']->escapeString($table);
$query = "SHOW TRIGGERS FROM $db WHERE `Table` = '$table'";
$handle = $GLOBALS['dbi']->tryQuery($query);
if ($handle === false) {

32
libraries/operations.lib.php
View File

@ -516,7 +516,7 @@ function PMA_runEventDefinitionsForDb($db)
{
$event_names = $GLOBALS['dbi']->fetchResult(
'SELECT EVENT_NAME FROM information_schema.EVENTS WHERE EVENT_SCHEMA= \''
. Util::sqlAddSlashes($db, true) . '\';'
. $GLOBALS['dbi']->escapeString($db) . '\';'
);
if ($event_names) {
foreach ($event_names as $event_name) {
@ -586,26 +586,26 @@ function PMA_AdjustPrivileges_moveDB($oldDb, $newname)
// For Db specific privileges
$query_db_specific = 'UPDATE ' . Util::backquote('db')
. 'SET Db = \'' . Util::sqlAddSlashes($newname)
. '\' where Db = \'' . Util::sqlAddSlashes($oldDb) . '\';';
. 'SET Db = \'' . $GLOBALS['dbi']->escapeString($newname)
. '\' where Db = \'' . $GLOBALS['dbi']->escapeString($oldDb) . '\';';
$GLOBALS['dbi']->query($query_db_specific);
// For table specific privileges
$query_table_specific = 'UPDATE ' . Util::backquote('tables_priv')
. 'SET Db = \'' . Util::sqlAddSlashes($newname)
. '\' where Db = \'' . Util::sqlAddSlashes($oldDb) . '\';';
. 'SET Db = \'' . $GLOBALS['dbi']->escapeString($newname)
. '\' where Db = \'' . $GLOBALS['dbi']->escapeString($oldDb) . '\';';
$GLOBALS['dbi']->query($query_table_specific);
// For column specific privileges
$query_col_specific = 'UPDATE ' . Util::backquote('columns_priv')
. 'SET Db = \'' . Util::sqlAddSlashes($newname)
. '\' where Db = \'' . Util::sqlAddSlashes($oldDb) . '\';';
. 'SET Db = \'' . $GLOBALS['dbi']->escapeString($newname)
. '\' where Db = \'' . $GLOBALS['dbi']->escapeString($oldDb) . '\';';
$GLOBALS['dbi']->query($query_col_specific);
// For procedures specific privileges
$query_proc_specific = 'UPDATE ' . Util::backquote('procs_priv')
. 'SET Db = \'' . Util::sqlAddSlashes($newname)
. '\' where Db = \'' . Util::sqlAddSlashes($oldDb) . '\';';
. 'SET Db = \'' . $GLOBALS['dbi']->escapeString($newname)
. '\' where Db = \'' . $GLOBALS['dbi']->escapeString($oldDb) . '\';';
$GLOBALS['dbi']->query($query_proc_specific);
// Finally FLUSH the new privileges
@ -1771,7 +1771,7 @@ function PMA_getTableAltersArray($is_myisam_or_aria, $is_isam, $pack_keys,
&& urldecode($_REQUEST['prev_comment']) !== $_REQUEST['comment']
) {
$table_alters[] = 'COMMENT = \''
. Util::sqlAddSlashes($_REQUEST['comment']) . '\'';
. $GLOBALS['dbi']->escapeString($_REQUEST['comment']) . '\'';
}
if (! empty($newTblStorageEngine)
@ -1830,7 +1830,7 @@ function PMA_getTableAltersArray($is_myisam_or_aria, $is_isam, $pack_keys,
|| $_REQUEST['new_auto_increment'] !== $auto_increment)
) {
$table_alters[] = 'auto_increment = '
. Util::sqlAddSlashes($_REQUEST['new_auto_increment']);
. $GLOBALS['dbi']->escapeString($_REQUEST['new_auto_increment']);
}
if (! empty($_REQUEST['new_row_format'])) {
@ -1841,7 +1841,7 @@ function PMA_getTableAltersArray($is_myisam_or_aria, $is_isam, $pack_keys,
|| $newRowFormatLower !== mb_strtolower($row_format))
) {
$table_alters[] = 'ROW_FORMAT = '
. Util::sqlAddSlashes($newRowFormat);
. $GLOBALS['dbi']->escapeString($newRowFormat);
}
}
@ -1945,15 +1945,15 @@ function PMA_AdjustPrivileges_renameOrMoveTable($oldDb, $oldTable, $newDb, $newT
// For table specific privileges
$query_table_specific = 'UPDATE ' . Util::backquote('tables_priv')
. 'SET Db = \'' . Util::sqlAddSlashes($newDb) . '\', Table_name = \'' . Util::sqlAddSlashes($newTable)
. '\' where Db = \'' . Util::sqlAddSlashes($oldDb) . '\' AND Table_name = \'' . Util::sqlAddSlashes($oldTable)
. 'SET Db = \'' . $GLOBALS['dbi']->escapeString($newDb) . '\', Table_name = \'' . $GLOBALS['dbi']->escapeString($newTable)
. '\' where Db = \'' . $GLOBALS['dbi']->escapeString($oldDb) . '\' AND Table_name = \'' . $GLOBALS['dbi']->escapeString($oldTable)
. '\';';
$GLOBALS['dbi']->query($query_table_specific);
// For column specific privileges
$query_col_specific = 'UPDATE ' . Util::backquote('columns_priv')
. 'SET Db = \'' . Util::sqlAddSlashes($newDb) . '\', Table_name = \'' . Util::sqlAddSlashes($newTable)
. '\' where Db = \'' . Util::sqlAddSlashes($oldDb) . '\' AND Table_name = \'' . Util::sqlAddSlashes($oldTable)
. 'SET Db = \'' . $GLOBALS['dbi']->escapeString($newDb) . '\', Table_name = \'' . $GLOBALS['dbi']->escapeString($newTable)
. '\' where Db = \'' . $GLOBALS['dbi']->escapeString($oldDb) . '\' AND Table_name = \'' . $GLOBALS['dbi']->escapeString($oldTable)
. '\';';
$GLOBALS['dbi']->query($query_col_specific);

28
libraries/plugins/export/ExportSql.php
View File

@ -949,7 +949,7 @@ class ExportSql extends ExportPlugin
$event_names = $GLOBALS['dbi']->fetchResult(
"SELECT EVENT_NAME FROM information_schema.EVENTS WHERE"
. " EVENT_SCHEMA= '" . Util::sqlAddSlashes($db, true)
. " EVENT_SCHEMA= '" . $GLOBALS['dbi']->escapeString($db)
. "';"
);
@ -1102,7 +1102,7 @@ class ExportSql extends ExportPlugin
. Util::backquote($cfgRelation['db'])
. "." . Util::backquote($cfgRelation[$type])
. " WHERE " . Util::backquote($dbNameColumn)
. " = '" . Util::sqlAddSlashes($db) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($db) . "'";
$result = $GLOBALS['dbi']->fetchResult(
$sql_query,
@ -1120,7 +1120,7 @@ class ExportSql extends ExportPlugin
. " WHERE " . Util::backquote(
$dbNameColumn
)
. " = '" . Util::sqlAddSlashes($db) . "'"
. " = '" . $GLOBALS['dbi']->escapeString($db) . "'"
. " AND `page_nr` = '" . intval($page) . "'";
if (!$this->exportData(
@ -1186,10 +1186,10 @@ class ExportSql extends ExportPlugin
$sql_query .= Util::backquote($cfgRelation['db'])
. '.' . Util::backquote($cfgRelation[$type])
. " WHERE " . Util::backquote($dbNameColumn)
. " = '" . Util::sqlAddSlashes($db) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($db) . "'";
if (isset($table)) {
$sql_query .= " AND `table_name` = '"
. Util::sqlAddSlashes($table) . "'";
. $GLOBALS['dbi']->escapeString($table) . "'";
}
if (!$this->exportData(
@ -1309,7 +1309,7 @@ class ExportSql extends ExportPlugin
}
if (isset($column['Default'])) {
$create_query .= " DEFAULT '"
. Util::sqlAddSlashes($column['Default']) . "'";
. $GLOBALS['dbi']->escapeString($column['Default']) . "'";
} else {
if ($column['Null'] == 'YES') {
$create_query .= " DEFAULT NULL";
@ -1317,7 +1317,7 @@ class ExportSql extends ExportPlugin
}
if (!empty($column['Comment'])) {
$create_query .= " COMMENT '"
. Util::sqlAddSlashes($column['Comment']) . "'";
. $GLOBALS['dbi']->escapeString($column['Comment']) . "'";
}
$firstCol = false;
}
@ -1389,7 +1389,7 @@ class ExportSql extends ExportPlugin
// with $GLOBALS['dbi']->numRows() in mysqli
$result = $GLOBALS['dbi']->query(
'SHOW TABLE STATUS FROM ' . Util::backquote($db)
. ' WHERE Name = \'' . Util::sqlAddSlashes($table) . '\'',
. ' WHERE Name = \'' . $GLOBALS['dbi']->escapeString($table) . '\'',
null,
DatabaseInterface::QUERY_STORE
);
@ -2405,7 +2405,7 @@ class ExportSql extends ExportPlugin
}
} elseif ($fields_meta[$j]->type == 'bit') {
// detection of 'bit' works only on mysqli extension
$values[] = "b'" . Util::sqlAddSlashes(
$values[] = "b'" . $GLOBALS['dbi']->escapeString(
Util::printableBitValue(
$row[$j],
$fields_meta[$j]->length
@ -2419,10 +2419,12 @@ class ExportSql extends ExportPlugin
} else {
// something else -> treat as a string
$values[] = '\''
. str_replace(
$search,
$replace,
Util::sqlAddSlashes($row[$j])
. $GLOBALS['dbi']->escapeString(
str_replace(
$search,
$replace,
$row[$j]
)
)
. '\'';
} // end if

2
libraries/plugins/export/ExportXml.php
View File

@ -253,7 +253,7 @@ class ExportXml extends ExportPlugin
$result = $GLOBALS['dbi']->fetchResult(
'SELECT `DEFAULT_CHARACTER_SET_NAME`, `DEFAULT_COLLATION_NAME`'
. ' FROM `information_schema`.`SCHEMATA` WHERE `SCHEMA_NAME`'
. ' = \'' . Util::sqlAddSlashes($db) . '\' LIMIT 1'
. ' = \'' . $GLOBALS['dbi']->escapeString($db) . '\' LIMIT 1'
);
$db_collation = $result[0]['DEFAULT_COLLATION_NAME'];
$db_charset = $result[0]['DEFAULT_CHARACTER_SET_NAME'];

2
libraries/plugins/import/ImportCsv.php
View File

@ -548,7 +548,7 @@ class ImportCsv extends AbstractImportCsv
$sql .= 'NULL';
} else {
$sql .= '\''
. PMA\libraries\Util::sqlAddSlashes($val)
. $GLOBALS['dbi']->escapeString($val)
. '\'';
}

6
libraries/plugins/import/ImportLdi.php
View File

@ -119,7 +119,7 @@ class ImportLdi extends AbstractImportCsv
if (isset($ldi_local_option)) {
$sql .= ' LOCAL';
}
$sql .= ' INFILE \'' . PMA\libraries\Util::sqlAddSlashes($import_file)
$sql .= ' INFILE \'' . $GLOBALS['dbi']->escapeString($import_file)
. '\'';
if (isset($ldi_replace)) {
$sql .= ' REPLACE';
@ -133,11 +133,11 @@ class ImportLdi extends AbstractImportCsv
}
if (strlen($ldi_enclosed) > 0) {
$sql .= ' ENCLOSED BY \''
. PMA\libraries\Util::sqlAddSlashes($ldi_enclosed) . '\'';
. $GLOBALS['dbi']->escapeString($ldi_enclosed) . '\'';
}
if (strlen($ldi_escaped) > 0) {
$sql .= ' ESCAPED BY \''
. PMA\libraries\Util::sqlAddSlashes($ldi_escaped) . '\'';
. $GLOBALS['dbi']->escapeString($ldi_escaped) . '\'';
}
if (strlen($ldi_new_line) > 0) {
if ($ldi_new_line == 'auto') {

2
libraries/plugins/schema/pdf/Pdf.php
View File

@ -240,7 +240,7 @@ class Pdf extends PDF_lib
$test_query = 'SELECT * FROM '
. Util::backquote($GLOBALS['cfgRelation']['db']) . '.'
. Util::backquote($GLOBALS['cfgRelation']['pdf_pages'])
. ' WHERE db_name = \'' . Util::sqlAddSlashes($this->_db)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($this->_db)
. '\' AND page_nr = \'' . $this->_pageNumber . '\'';
$test_rs = PMA_queryAsControlUser($test_query);
$pages = @$GLOBALS['dbi']->fetchAssoc($test_rs);

48
libraries/pmd_common.php
View File

@ -350,8 +350,8 @@ function PMA_getDefaultPage($db)
$query = "SELECT `page_nr`"
. " FROM " . PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['pdf_pages'])
. " WHERE `db_name` = '" . PMA\libraries\Util::sqlAddSlashes($db) . "'"
. " AND `page_descr` = '" . PMA\libraries\Util::sqlAddSlashes($db) . "'";
. " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($db) . "'"
. " AND `page_descr` = '" . $GLOBALS['dbi']->escapeString($db) . "'";
$default_page_no = $GLOBALS['dbi']->fetchResult(
$query,
@ -391,7 +391,7 @@ function PMA_getLoadingPage($db)
$query = "SELECT MIN(`page_nr`)"
. " FROM " . PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['pdf_pages'])
. " WHERE `db_name` = '" . PMA\libraries\Util::sqlAddSlashes($db) . "'";
. " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($db) . "'";
$min_page_no = $GLOBALS['dbi']->fetchResult(
$query,
@ -448,9 +448,9 @@ function PMA_saveTablePositions($pg)
. "." . PMA\libraries\Util::backquote(
$GLOBALS['cfgRelation']['table_coords']
)
. " WHERE `db_name` = '" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['db'])
. " WHERE `db_name` = '" . $GLOBALS['dbi']->escapeString($_REQUEST['db'])
. "'"
. " AND `pdf_page_number` = '" . PMA\libraries\Util::sqlAddSlashes($pg)
. " AND `pdf_page_number` = '" . $GLOBALS['dbi']->escapeString($pg)
. "'";
$res = PMA_queryAsControlUser(
@ -474,11 +474,11 @@ function PMA_saveTablePositions($pg)
. PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['table_coords'])
. " (`db_name`, `table_name`, `pdf_page_number`, `x`, `y`)"
. " VALUES ("
. "'" . PMA\libraries\Util::sqlAddSlashes($DB) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($TAB) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($pg) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['t_x'][$key]) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['t_y'][$key]) . "')";
. "'" . $GLOBALS['dbi']->escapeString($DB) . "', "
. "'" . $GLOBALS['dbi']->escapeString($TAB) . "', "
. "'" . $GLOBALS['dbi']->escapeString($pg) . "', "
. "'" . $GLOBALS['dbi']->escapeString($_REQUEST['t_x'][$key]) . "', "
. "'" . $GLOBALS['dbi']->escapeString($_REQUEST['t_y'][$key]) . "')";
$res = PMA_queryAsControlUser(
$query, true, PMA\libraries\DatabaseInterface::QUERY_STORE
@ -621,12 +621,12 @@ function PMA_addNewRelation($db, $T1, $F1, $T2, $F2, $on_delete, $on_update)
. "(master_db, master_table, master_field, "
. "foreign_db, foreign_table, foreign_field)"
. " values("
. "'" . PMA\libraries\Util::sqlAddSlashes($db) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($T2) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($F2) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($db) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($T1) . "', "
. "'" . PMA\libraries\Util::sqlAddSlashes($F1) . "')";
. "'" . $GLOBALS['dbi']->escapeString($db) . "', "
. "'" . $GLOBALS['dbi']->escapeString($T2) . "', "
. "'" . $GLOBALS['dbi']->escapeString($F2) . "', "
. "'" . $GLOBALS['dbi']->escapeString($db) . "', "
. "'" . $GLOBALS['dbi']->escapeString($T1) . "', "
. "'" . $GLOBALS['dbi']->escapeString($F1) . "')";
if (PMA_queryAsControlUser($q, false, PMA\libraries\DatabaseInterface::QUERY_STORE)
) {
@ -690,12 +690,12 @@ function PMA_removeRelation($T1, $F1, $T2, $F2)
$delete_query = "DELETE FROM "
. PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['db']) . "."
. $GLOBALS['cfgRelation']['relation'] . " WHERE "
. "master_db = '" . PMA\libraries\Util::sqlAddSlashes($DB2) . "'"
. " AND master_table = '" . PMA\libraries\Util::sqlAddSlashes($T2) . "'"
. " AND master_field = '" . PMA\libraries\Util::sqlAddSlashes($F2) . "'"
. " AND foreign_db = '" . PMA\libraries\Util::sqlAddSlashes($DB1) . "'"
. " AND foreign_table = '" . PMA\libraries\Util::sqlAddSlashes($T1) . "'"
. " AND foreign_field = '" . PMA\libraries\Util::sqlAddSlashes($F1) . "'";
. "master_db = '" . $GLOBALS['dbi']->escapeString($DB2) . "'"
. " AND master_table = '" . $GLOBALS['dbi']->escapeString($T2) . "'"
. " AND master_field = '" . $GLOBALS['dbi']->escapeString($F2) . "'"
. " AND foreign_db = '" . $GLOBALS['dbi']->escapeString($DB1) . "'"
. " AND foreign_table = '" . $GLOBALS['dbi']->escapeString($T1) . "'"
. " AND foreign_field = '" . $GLOBALS['dbi']->escapeString($F1) . "'";
$result = PMA_queryAsControlUser(
$delete_query,
@ -738,7 +738,7 @@ function PMA_saveDesignerSetting($index, $value)
. " FROM " . PMA\libraries\Util::backquote($cfgDesigner['db'])
. "." . PMA\libraries\Util::backquote($cfgDesigner['table'])
. " WHERE username = '"
. PMA\libraries\Util::sqlAddSlashes($cfgDesigner['user']) . "';";
. $GLOBALS['dbi']->escapeString($cfgDesigner['user']) . "';";
$orig_data = $GLOBALS['dbi']->fetchSingleRow(
$orig_data_query, 'ASSOC', $GLOBALS['controllink']
@ -754,7 +754,7 @@ function PMA_saveDesignerSetting($index, $value)
. "." . PMA\libraries\Util::backquote($cfgDesigner['table'])
. " SET settings_data = '" . $orig_data . "'"
. " WHERE username = '"
. PMA\libraries\Util::sqlAddSlashes($cfgDesigner['user']) . "';";
. $GLOBALS['dbi']->escapeString($cfgDesigner['user']) . "';";
$success = PMA_queryAsControlUser($save_query);
} else {

92
libraries/relation.lib.php
View File

@ -757,12 +757,12 @@ function PMA_getForeigners($db, $table, $column = '', $source = 'both')
`foreign_field`
FROM ' . PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation']) . '
WHERE `master_db` = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'
AND `master_table` = \'' . PMA\libraries\Util::sqlAddSlashes($table)
WHERE `master_db` = \'' . $GLOBALS['dbi']->escapeString($db) . '\'
AND `master_table` = \'' . $GLOBALS['dbi']->escapeString($table)
. '\' ';
if (strlen($column) > 0) {
$rel_query .= ' AND `master_field` = '
. '\'' . PMA\libraries\Util::sqlAddSlashes($column) . '\'';
. '\'' . $GLOBALS['dbi']->escapeString($column) . '\'';
}
$foreign = $GLOBALS['dbi']->fetchResult(
$rel_query, 'master_field', null, $GLOBALS['controllink']
@ -836,8 +836,8 @@ function PMA_getDisplayField($db, $table)
SELECT `display_field`
FROM ' . PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_info']) . '
WHERE `db_name` = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'
AND `table_name` = \'' . PMA\libraries\Util::sqlAddSlashes($table)
WHERE `db_name` = \'' . $GLOBALS['dbi']->escapeString($db) . '\'
AND `table_name` = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
$row = $GLOBALS['dbi']->fetchSingleRow(
@ -919,7 +919,7 @@ function PMA_getDbComment($db)
FROM " . PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['column_info'])
. "
WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($db) . "'
WHERE db_name = '" . $GLOBALS['dbi']->escapeString($db) . "'
AND table_name = ''
AND column_name = '(db_comment)'";
$com_rs = PMA_queryAsControlUser(
@ -995,17 +995,17 @@ function PMA_setDbComment($db, $comment = '')
. PMA\libraries\Util::backquote($cfgRelation['column_info'])
. ' (`db_name`, `table_name`, `column_name`, `comment`)'
. ' VALUES (\''
. PMA\libraries\Util::sqlAddSlashes($db)
. $GLOBALS['dbi']->escapeString($db)
. "', '', '(db_comment)', '"
. PMA\libraries\Util::sqlAddSlashes($comment)
. $GLOBALS['dbi']->escapeString($comment)
. "') "
. ' ON DUPLICATE KEY UPDATE '
. "`comment` = '" . PMA\libraries\Util::sqlAddSlashes($comment) . "'";
. "`comment` = '" . $GLOBALS['dbi']->escapeString($comment) . "'";
} else {
$upd_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['column_info'])
. ' WHERE `db_name` = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE `db_name` = \'' . $GLOBALS['dbi']->escapeString($db)
. '\'
AND `table_name` = \'\'
AND `column_name` = \'(db_comment)\'';
@ -1071,11 +1071,11 @@ function PMA_setHistory($db, $table, $username, $sqlquery)
`timevalue`,
`sqlquery`)
VALUES
(\'' . PMA\libraries\Util::sqlAddSlashes($username) . '\',
\'' . PMA\libraries\Util::sqlAddSlashes($db) . '\',
\'' . PMA\libraries\Util::sqlAddSlashes($table) . '\',
(\'' . $GLOBALS['dbi']->escapeString($username) . '\',
\'' . $GLOBALS['dbi']->escapeString($db) . '\',
\'' . $GLOBALS['dbi']->escapeString($table) . '\',
NOW(),
\'' . PMA\libraries\Util::sqlAddSlashes($sqlquery) . '\')'
\'' . $GLOBALS['dbi']->escapeString($sqlquery) . '\')'
);
PMA_purgeHistory($username);
@ -1117,7 +1117,7 @@ function PMA_getHistory($username)
`timevalue`
FROM ' . PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['history']) . '
WHERE `username` = \'' . PMA\libraries\Util::sqlAddSlashes($username) . '\'
WHERE `username` = \'' . $GLOBALS['dbi']->escapeString($username) . '\'
ORDER BY `id` DESC';
return $GLOBALS['dbi']->fetchResult(
@ -1152,7 +1152,7 @@ function PMA_purgeHistory($username)
SELECT `timevalue`
FROM ' . PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['history']) . '
WHERE `username` = \'' . PMA\libraries\Util::sqlAddSlashes($username) . '\'
WHERE `username` = \'' . $GLOBALS['dbi']->escapeString($username) . '\'
ORDER BY `timevalue` DESC
LIMIT ' . $GLOBALS['cfg']['QueryHistoryMax'] . ', 1';
@ -1163,7 +1163,7 @@ function PMA_purgeHistory($username)
'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['history']) . '
WHERE `username` = \'' . PMA\libraries\Util::sqlAddSlashes($username)
WHERE `username` = \'' . $GLOBALS['dbi']->escapeString($username)
. '\'
AND `timevalue` <= \'' . $max_time . '\''
);
@ -1387,7 +1387,7 @@ function PMA_getForeignData(
. '.' . PMA\libraries\Util::backquote($foreign_table);
$f_query_filter = empty($foreign_filter) ? '' : ' WHERE '
. PMA\libraries\Util::backquote($foreign_field)
. ' LIKE "%' . PMA\libraries\Util::sqlAddSlashes(
. ' LIKE "%' . $GLOBALS['dbi']->escapeString(
$foreign_filter,
true
) . '%"'
@ -1395,7 +1395,7 @@ function PMA_getForeignData(
($foreign_display == false)
? ''
: ' OR ' . PMA\libraries\Util::backquote($foreign_display)
. ' LIKE "%' . PMA\libraries\Util::sqlAddSlashes(
. ' LIKE "%' . $GLOBALS['dbi']->escapeString(
$foreign_filter,
true
)
@ -1480,14 +1480,14 @@ function PMA_REL_renameField($db, $table, $field, $new_name)
$table_query = 'UPDATE '
. PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['table_info'])
. ' SET display_field = \'' . PMA\libraries\Util::sqlAddSlashes(
. ' SET display_field = \'' . $GLOBALS['dbi']->escapeString(
$new_name
) . '\''
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND display_field = \'' . PMA\libraries\Util::sqlAddSlashes($field)
. ' AND display_field = \'' . $GLOBALS['dbi']->escapeString($field)
. '\'';
PMA_queryAsControlUser($table_query);
}
@ -1496,28 +1496,28 @@ function PMA_REL_renameField($db, $table, $field, $new_name)
$table_query = 'UPDATE '
. PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' SET master_field = \'' . PMA\libraries\Util::sqlAddSlashes(
. ' SET master_field = \'' . $GLOBALS['dbi']->escapeString(
$new_name
) . '\''
. ' WHERE master_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE master_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND master_table = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND master_table = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND master_field = \'' . PMA\libraries\Util::sqlAddSlashes($field)
. ' AND master_field = \'' . $GLOBALS['dbi']->escapeString($field)
. '\'';
PMA_queryAsControlUser($table_query);
$table_query = 'UPDATE '
. PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' SET foreign_field = \'' . PMA\libraries\Util::sqlAddSlashes(
. ' SET foreign_field = \'' . $GLOBALS['dbi']->escapeString(
$new_name
) . '\''
. ' WHERE foreign_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE foreign_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND foreign_table = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND foreign_table = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND foreign_field = \'' . PMA\libraries\Util::sqlAddSlashes($field)
. ' AND foreign_field = \'' . $GLOBALS['dbi']->escapeString($field)
. '\'';
PMA_queryAsControlUser($table_query);
@ -1547,14 +1547,14 @@ function PMA_REL_renameSingleTable($table,
. PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['db']) . '.'
. PMA\libraries\Util::backquote($GLOBALS['cfgRelation'][$table])
. ' SET '
. $db_field . ' = \'' . PMA\libraries\Util::sqlAddSlashes($target_db)
. $db_field . ' = \'' . $GLOBALS['dbi']->escapeString($target_db)
. '\', '
. $table_field . ' = \'' . PMA\libraries\Util::sqlAddSlashes($target_table)
. $table_field . ' = \'' . $GLOBALS['dbi']->escapeString($target_table)
. '\''
. ' WHERE '
. $db_field . ' = \'' . PMA\libraries\Util::sqlAddSlashes($source_db) . '\''
. $db_field . ' = \'' . $GLOBALS['dbi']->escapeString($source_db) . '\''
. ' AND '
. $table_field . ' = \'' . PMA\libraries\Util::sqlAddSlashes($source_table)
. $table_field . ' = \'' . $GLOBALS['dbi']->escapeString($source_table)
. '\'';
PMA_queryAsControlUser($query);
}
@ -1627,8 +1627,8 @@ function PMA_REL_renameTable($source_db, $target_db, $source_table, $target_tabl
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['db']) . "."
. PMA\libraries\Util::backquote($GLOBALS['cfgRelation']['table_coords'])
. " WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($source_db) . "'"
. " AND table_name = '" . PMA\libraries\Util::sqlAddSlashes($source_table)
. " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($source_db) . "'"
. " AND table_name = '" . $GLOBALS['dbi']->escapeString($source_table)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -1658,13 +1658,13 @@ function PMA_REL_renameTable($source_db, $target_db, $source_table, $target_tabl
. PMA\libraries\Util::backquote(
$GLOBALS['cfgRelation']['navigationhiding']
)
. " SET db_name = '" . PMA\libraries\Util::sqlAddSlashes($target_db)
. " SET db_name = '" . $GLOBALS['dbi']->escapeString($target_db)
. "',"
. " item_name = '" . PMA\libraries\Util::sqlAddSlashes($target_table)
. " item_name = '" . $GLOBALS['dbi']->escapeString($target_table)
. "'"
. " WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($source_db)
. " WHERE db_name = '" . $GLOBALS['dbi']->escapeString($source_db)
. "'"
. " AND item_name = '" . PMA\libraries\Util::sqlAddSlashes($source_table)
. " AND item_name = '" . $GLOBALS['dbi']->escapeString($source_table)
. "'"
. " AND item_type = 'table'";
PMA_queryAsControlUser($query);
@ -1690,8 +1690,8 @@ function PMA_REL_createPage($newpage, $cfgRelation, $db)
. PMA\libraries\Util::backquote($cfgRelation['pdf_pages'])
. ' (db_name, page_descr)'
. ' VALUES (\''
. PMA\libraries\Util::sqlAddSlashes($db) . '\', \''
. PMA\libraries\Util::sqlAddSlashes($newpage) . '\')';
. $GLOBALS['dbi']->escapeString($db) . '\', \''
. $GLOBALS['dbi']->escapeString($newpage) . '\')';
PMA_queryAsControlUser($ins_query, false);
return $GLOBALS['dbi']->insertId(
@ -1717,12 +1717,12 @@ function PMA_getChildReferences($db, $table, $column = '')
. " `table_schema`, `referenced_column_name`"
. " FROM `information_schema`.`key_column_usage`"
. " WHERE `referenced_table_name` = '"
. PMA\libraries\Util::sqlAddSlashes($table) . "'"
. $GLOBALS['dbi']->escapeString($table) . "'"
. " AND `referenced_table_schema` = '"
. PMA\libraries\Util::sqlAddSlashes($db) . "'";
. $GLOBALS['dbi']->escapeString($db) . "'";
if ($column) {
$rel_query .= " AND `referenced_column_name` = '"
. PMA\libraries\Util::sqlAddSlashes($column) . "'";
. $GLOBALS['dbi']->escapeString($column) . "'";
}
$child_references = $GLOBALS['dbi']->fetchResult(

96
libraries/relation_cleanup.lib.php
View File

@ -23,10 +23,10 @@ function PMA_relationsCleanupColumn($db, $table, $column)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['column_info'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND column_name = \'' . PMA\libraries\Util::sqlAddSlashes($column)
. ' AND column_name = \'' . $GLOBALS['dbi']->escapeString($column)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -35,10 +35,10 @@ function PMA_relationsCleanupColumn($db, $table, $column)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_info'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND display_field = \'' . PMA\libraries\Util::sqlAddSlashes($column)
. ' AND display_field = \'' . $GLOBALS['dbi']->escapeString($column)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -47,22 +47,22 @@ function PMA_relationsCleanupColumn($db, $table, $column)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' WHERE master_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE master_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND master_table = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND master_table = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND master_field = \'' . PMA\libraries\Util::sqlAddSlashes($column)
. ' AND master_field = \'' . $GLOBALS['dbi']->escapeString($column)
. '\'';
PMA_queryAsControlUser($remove_query);
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' WHERE foreign_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE foreign_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND foreign_table = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND foreign_table = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND foreign_field = \'' . PMA\libraries\Util::sqlAddSlashes($column)
. ' AND foreign_field = \'' . $GLOBALS['dbi']->escapeString($column)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -84,8 +84,8 @@ function PMA_relationsCleanupTable($db, $table)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['column_info'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -94,8 +94,8 @@ function PMA_relationsCleanupTable($db, $table)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_info'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -104,8 +104,8 @@ function PMA_relationsCleanupTable($db, $table)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_coords'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -114,18 +114,18 @@ function PMA_relationsCleanupTable($db, $table)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' WHERE master_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE master_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND master_table = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND master_table = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
PMA_queryAsControlUser($remove_query);
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' WHERE foreign_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE foreign_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\''
. ' AND foreign_table = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' AND foreign_table = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -134,8 +134,8 @@ function PMA_relationsCleanupTable($db, $table)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_uiprefs'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -144,10 +144,10 @@ function PMA_relationsCleanupTable($db, $table)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['navigationhiding'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\''
. ' AND (table_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\''
. ' AND (table_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' OR (item_name = \'' . PMA\libraries\Util::sqlAddSlashes($table)
. ' OR (item_name = \'' . $GLOBALS['dbi']->escapeString($table)
. '\''
. ' AND item_type = \'table\'))';
PMA_queryAsControlUser($remove_query);
@ -169,7 +169,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['column_info'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -177,7 +177,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['bookmark'])
. ' WHERE dbase = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE dbase = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -185,7 +185,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_info'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -193,13 +193,13 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['pdf_pages'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_coords'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -208,13 +208,13 @@ function PMA_relationsCleanupDatabase($db)
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' WHERE master_db = \''
. PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['relation'])
. ' WHERE foreign_db = \'' . PMA\libraries\Util::sqlAddSlashes($db)
. ' WHERE foreign_db = \'' . $GLOBALS['dbi']->escapeString($db)
. '\'';
PMA_queryAsControlUser($remove_query);
}
@ -223,7 +223,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['table_uiprefs'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -231,7 +231,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['navigationhiding'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -239,7 +239,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['savedsearches'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
@ -247,7 +247,7 @@ function PMA_relationsCleanupDatabase($db)
$remove_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['central_columns'])
. ' WHERE db_name = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'';
. ' WHERE db_name = \'' . $GLOBALS['dbi']->escapeString($db) . '\'';
PMA_queryAsControlUser($remove_query);
}
}
@ -267,7 +267,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['bookmark'])
. " WHERE `user` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `user` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -276,7 +276,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['history'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -285,7 +285,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['recent'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -294,7 +294,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['favorite'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -303,7 +303,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['table_uiprefs'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -312,7 +312,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['userconfig'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -321,7 +321,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['users'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -330,7 +330,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['navigationhiding'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -339,7 +339,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['savedsearches'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}
@ -348,7 +348,7 @@ function PMA_relationsCleanupUser($username)
$remove_query = "DELETE FROM "
. PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['designer_settings'])
. " WHERE `username` = '" . PMA\libraries\Util::sqlAddSlashes($username)
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username)
. "'";
PMA_queryAsControlUser($remove_query);
}

2
libraries/replication.inc.php
View File

@ -28,7 +28,7 @@ if (! empty($_REQUEST['master_connection'])) {
if ($server_slave_multi_replication) {
$GLOBALS['dbi']->query(
"SET @@default_master_connection = '"
. PMA\libraries\Util::sqlAddSlashes(
. $GLOBALS['dbi']->escapeString(
$_REQUEST['master_connection']
) . "'"
);

8
libraries/replication_gui.lib.php
View File

@ -962,13 +962,13 @@ function PMA_handleRequestForSlaveChangeMaster()
{
$sr = array();
$_SESSION['replication']['m_username'] = $sr['username']
= PMA\libraries\Util::sqlAddSlashes($_REQUEST['username']);
= $GLOBALS['dbi']->escapeString($_REQUEST['username']);
$_SESSION['replication']['m_password'] = $sr['pma_pw']
= PMA\libraries\Util::sqlAddSlashes($_REQUEST['pma_pw']);
= $GLOBALS['dbi']->escapeString($_REQUEST['pma_pw']);
$_SESSION['replication']['m_hostname'] = $sr['hostname']
= PMA\libraries\Util::sqlAddSlashes($_REQUEST['hostname']);
= $GLOBALS['dbi']->escapeString($_REQUEST['hostname']);
$_SESSION['replication']['m_port'] = $sr['port']
= PMA\libraries\Util::sqlAddSlashes($_REQUEST['text_port']);
= $GLOBALS['dbi']->escapeString($_REQUEST['text_port']);
$_SESSION['replication']['m_correct'] = '';
$_SESSION['replication']['sr_action_status'] = 'error';
$_SESSION['replication']['sr_action_info'] = __('Unknown error');

10
libraries/rte/rte_events.lib.php
View File

@ -288,8 +288,8 @@ function PMA_EVN_getDataFromName($name)
. "`INTERVAL_VALUE`, `INTERVAL_FIELD`, `STARTS`, `ENDS`, "
. "`EVENT_DEFINITION`, `ON_COMPLETION`, `DEFINER`, `EVENT_COMMENT`";
$where = "EVENT_SCHEMA " . PMA\libraries\Util::getCollateForIS() . "="
. "'" . PMA\libraries\Util::sqlAddSlashes($db) . "' "
. "AND EVENT_NAME='" . PMA\libraries\Util::sqlAddSlashes($name) . "'";
. "'" . $GLOBALS['dbi']->escapeString($db) . "' "
. "AND EVENT_NAME='" . $GLOBALS['dbi']->escapeString($name) . "'";
$query = "SELECT $columns FROM `INFORMATION_SCHEMA`.`EVENTS` WHERE $where;";
$item = $GLOBALS['dbi']->fetchSingleRow($query);
if (! $item) {
@ -562,18 +562,18 @@ function PMA_EVN_getQueryFromRequest()
}
if (! empty($_REQUEST['item_starts'])) {
$query .= "STARTS '"
. PMA\libraries\Util::sqlAddSlashes($_REQUEST['item_starts'])
. $GLOBALS['dbi']->escapeString($_REQUEST['item_starts'])
. "' ";
}
if (! empty($_REQUEST['item_ends'])) {
$query .= "ENDS '"
. PMA\libraries\Util::sqlAddSlashes($_REQUEST['item_ends'])
. $GLOBALS['dbi']->escapeString($_REQUEST['item_ends'])
. "' ";
}
} else {
if (! empty($_REQUEST['item_execute_at'])) {
$query .= "AT '"
. PMA\libraries\Util::sqlAddSlashes($_REQUEST['item_execute_at'])
. $GLOBALS['dbi']->escapeString($_REQUEST['item_execute_at'])
. "' ";
} else {
$errors[]

6
libraries/rte/rte_list.lib.php
View File

@ -208,9 +208,9 @@ function PMA_RTN_getRowForList($routine, $rowclass = '')
// this is for our purpose to decide whether to
// show the edit link or not, so we need the DEFINER for the routine
$where = "ROUTINE_SCHEMA " . PMA\libraries\Util::getCollateForIS() . "="
. "'" . PMA\libraries\Util::sqlAddSlashes($db) . "' "
. "AND SPECIFIC_NAME='" . PMA\libraries\Util::sqlAddSlashes($routine['name']) . "'"
. "AND ROUTINE_TYPE='" . PMA\libraries\Util::sqlAddSlashes($routine['type']) . "'";
. "'" . $GLOBALS['dbi']->escapeString($db) . "' "
. "AND SPECIFIC_NAME='" . $GLOBALS['dbi']->escapeString($routine['name']) . "'"
. "AND ROUTINE_TYPE='" . $GLOBALS['dbi']->escapeString($routine['type']) . "'";
$query = "SELECT `DEFINER` FROM INFORMATION_SCHEMA.ROUTINES WHERE $where;";
$routine_definer = $GLOBALS['dbi']->fetchValue($query, 0, 0, $GLOBALS['controllink']);

10
libraries/rte/rte_routines.lib.php
View File

@ -590,9 +590,9 @@ function PMA_RTN_getDataFromName($name, $type, $all = true, $control = false)
. "ROUTINE_DEFINITION, IS_DETERMINISTIC, SQL_DATA_ACCESS, "
. "ROUTINE_COMMENT, SECURITY_TYPE";
$where = "ROUTINE_SCHEMA " . PMA\libraries\Util::getCollateForIS() . "="
. "'" . PMA\libraries\Util::sqlAddSlashes($db) . "' "
. "AND SPECIFIC_NAME='" . PMA\libraries\Util::sqlAddSlashes($name) . "'"
. "AND ROUTINE_TYPE='" . PMA\libraries\Util::sqlAddSlashes($type) . "'";
. "'" . $GLOBALS['dbi']->escapeString($db) . "' "
. "AND SPECIFIC_NAME='" . $GLOBALS['dbi']->escapeString($name) . "'"
. "AND ROUTINE_TYPE='" . $GLOBALS['dbi']->escapeString($type) . "'";
$query = "SELECT $fields FROM INFORMATION_SCHEMA.ROUTINES WHERE $where;";
$routine = $GLOBALS['dbi']->fetchSingleRow($query, 'ASSOC', $link);
@ -1267,7 +1267,7 @@ function PMA_RTN_getQueryFromRequest()
$query .= ' ';
}
if (! empty($_REQUEST['item_comment'])) {
$query .= "COMMENT '" . PMA\libraries\Util::sqlAddslashes($_REQUEST['item_comment'])
$query .= "COMMENT '" . $GLOBALS['dbi']->escapeString($_REQUEST['item_comment'])
. "' ";
}
if (isset($_REQUEST['item_isdeterministic'])) {
@ -1342,7 +1342,7 @@ function PMA_RTN_handleExecute()
if (is_array($value)) { // is SET type
$value = implode(',', $value);
}
$value = PMA\libraries\Util::sqlAddSlashes($value);
$value = $GLOBALS['dbi']->escapeString($value);
if (! empty($_REQUEST['funcs'][$routine['item_param_name'][$i]])
&& in_array(
$_REQUEST['funcs'][$routine['item_param_name'][$i]],

2
libraries/rte/rte_triggers.lib.php
View File

@ -311,7 +311,7 @@ function PMA_TRI_getEditorForm($mode, $item)
. "type='hidden' value='{$item['item_original_name']}'/>\n";
}
$query = "SELECT `TABLE_NAME` FROM `INFORMATION_SCHEMA`.`TABLES` ";
$query .= "WHERE `TABLE_SCHEMA`='" . PMA\libraries\Util::sqlAddSlashes($db) . "' ";
$query .= "WHERE `TABLE_SCHEMA`='" . $GLOBALS['dbi']->escapeString($db) . "' ";
$query .= "AND `TABLE_TYPE`='BASE TABLE'";
$tables = $GLOBALS['dbi']->fetchResult($query);

184
libraries/server_privileges.lib.php
View File

@ -84,9 +84,9 @@ function PMA_rangeOfUsers($initial = '')
}
$ret = " WHERE `User` LIKE '"
. Util::sqlAddSlashes($initial, true) . "%'"
. $GLOBALS['dbi']->escapeString($initial) . "%'"
. " OR `User` LIKE '"
. Util::sqlAddSlashes(mb_strtolower($initial), true)
. $GLOBALS['dbi']->escapeString(mb_strtolower($initial))
. "%'";
return $ret;
} // end function
@ -493,21 +493,21 @@ function PMA_getSqlQueryForDisplayPrivTable($db, $table, $username, $hostname)
{
if ($db == '*') {
return "SELECT * FROM `mysql`.`user`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "';";
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "';";
} elseif ($table == '*') {
return "SELECT * FROM `mysql`.`db`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
. " AND '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " AND '" . $GLOBALS['dbi']->escapeString(Util::unescapeMysqlWildcards($db)) . "'"
. " LIKE `Db`;";
}
return "SELECT `Table_priv`"
. " FROM `mysql`.`tables_priv`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
. " AND `Db` = '" . Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
. " AND `Table_name` = '" . Util::sqlAddSlashes($table) . "';";
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " AND `Db` = '" . $GLOBALS['dbi']->escapeString(Util::unescapeMysqlWildcards($db)) . "'"
. " AND `Table_name` = '" . $GLOBALS['dbi']->escapeString($table) . "';";
}
/**
@ -546,7 +546,7 @@ function PMA_getHtmlToChooseUserGroup($username)
$userGroup = '';
if (isset($GLOBALS['username'])) {
$sql_query = "SELECT `usergroup` FROM " . $userTable
. " WHERE `username` = '" . Util::sqlAddSlashes($username) . "'";
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username) . "'";
$userGroup = $GLOBALS['dbi']->fetchValue(
$sql_query, 0, 0, $GLOBALS['controllink']
);
@ -584,23 +584,23 @@ function PMA_setUserGroup($username, $userGroup)
. "." . Util::backquote($cfgRelation['users']);
$sql_query = "SELECT `usergroup` FROM " . $userTable
. " WHERE `username` = '" . Util::sqlAddSlashes($username) . "'";
. " WHERE `username` = '" . $GLOBALS['dbi']->escapeString($username) . "'";
$oldUserGroup = $GLOBALS['dbi']->fetchValue(
$sql_query, 0, 0, $GLOBALS['controllink']
);
if ($oldUserGroup === false) {
$upd_query = "INSERT INTO " . $userTable . "(`username`, `usergroup`)"
. " VALUES ('" . Util::sqlAddSlashes($username) . "', "
. "'" . Util::sqlAddSlashes($userGroup) . "')";
. " VALUES ('" . $GLOBALS['dbi']->escapeString($username) . "', "
. "'" . $GLOBALS['dbi']->escapeString($userGroup) . "')";
} else {
if (empty($userGroup)) {
$upd_query = "DELETE FROM " . $userTable
. " WHERE `username`='" . Util::sqlAddSlashes($username) . "'";
. " WHERE `username`='" . $GLOBALS['dbi']->escapeString($username) . "'";
} elseif ($oldUserGroup != $userGroup) {
$upd_query = "UPDATE " . $userTable
. " SET `usergroup`='" . Util::sqlAddSlashes($userGroup) . "'"
. " WHERE `username`='" . Util::sqlAddSlashes($username) . "'";
. " SET `usergroup`='" . $GLOBALS['dbi']->escapeString($userGroup) . "'"
. " WHERE `username`='" . $GLOBALS['dbi']->escapeString($username) . "'";
}
}
if (isset($upd_query)) {
@ -981,11 +981,11 @@ function PMA_getHtmlForRoutineSpecificPrivilges(
$sql = "SELECT `Proc_priv`"
. " FROM `mysql`.`procs_priv`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "'"
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " AND `Db` = '"
. Util::sqlAddSlashes(Util::unescapeMysqlWildcards($db)) . "'"
. " AND `Routine_name` LIKE '" . Util::sqlAddSlashes($routine) . "';";
. $GLOBALS['dbi']->escapeString(Util::unescapeMysqlWildcards($db)) . "'"
. " AND `Routine_name` LIKE '" . $GLOBALS['dbi']->escapeString($routine) . "';";
$res = $GLOBALS['dbi']->fetchValue($sql);
$privs = PMA_parseProcPriv($res);
@ -1060,15 +1060,15 @@ function PMA_getHtmlForTableSpecificPrivileges(
'SELECT `Column_name`, `Column_priv`'
. ' FROM `mysql`.`columns_priv`'
. ' WHERE `User`'
. ' = \'' . Util::sqlAddSlashes($username) . "'"
. ' = \'' . $GLOBALS['dbi']->escapeString($username) . "'"
. ' AND `Host`'
. ' = \'' . Util::sqlAddSlashes($hostname) . "'"
. ' = \'' . $GLOBALS['dbi']->escapeString($hostname) . "'"
. ' AND `Db`'
. ' = \'' . Util::sqlAddSlashes(
. ' = \'' . $GLOBALS['dbi']->escapeString(
Util::unescapeMysqlWildcards($db)
) . "'"
. ' AND `Table_name`'
. ' = \'' . Util::sqlAddSlashes($table) . '\';'
. ' = \'' . $GLOBALS['dbi']->escapeString($table) . '\';'
);
while ($row1 = $GLOBALS['dbi']->fetchRow($res)) {
@ -1955,8 +1955,8 @@ function PMA_getGrants($user, $host)
{
$grants = $GLOBALS['dbi']->fetchResult(
"SHOW GRANTS FOR '"
. Util::sqlAddSlashes($user) . "'@'"
. Util::sqlAddSlashes($host) . "'"
. $GLOBALS['dbi']->escapeString($user) . "'@'"
. $GLOBALS['dbi']->escapeString($host) . "'"
);
$response = '';
foreach ($grants as $one_grant) {
@ -2010,15 +2010,15 @@ function PMA_updatePassword($err_url, $username, $hostname)
) {
if ($authentication_plugin != 'mysql_old_password') {
$query_prefix = "ALTER USER '"
. Util::sqlAddSlashes($username)
. "'@'" . Util::sqlAddSlashes($hostname) . "'"
. $GLOBALS['dbi']->escapeString($username)
. "'@'" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " IDENTIFIED WITH "
. $authentication_plugin
. " BY '";
} else {
$query_prefix = "ALTER USER '"
. Util::sqlAddSlashes($username)
. "'@'" . Util::sqlAddSlashes($hostname) . "'"
. $GLOBALS['dbi']->escapeString($username)
. "'@'" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " IDENTIFIED BY '";
}
@ -2026,7 +2026,7 @@ function PMA_updatePassword($err_url, $username, $hostname)
$sql_query = $query_prefix . "*'";
$local_query = $query_prefix
. Util::sqlAddSlashes($_POST['pma_pw']) . "'";
. $GLOBALS['dbi']->escapeString($_POST['pma_pw']) . "'";
} else if ($serverType == 'MariaDB'
&& PMA_MYSQL_INT_VERSION >= 50200
&& $is_superuser
@ -2046,8 +2046,8 @@ function PMA_updatePassword($err_url, $username, $hostname)
$hashedPassword = PMA_getHashedPassword($_POST['pma_pw']);
$sql_query = 'SET PASSWORD FOR \''
. Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\' = '
. $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\' = '
. (($_POST['pma_pw'] == '')
? '\'\''
: $hashing_function . '(\''
@ -2091,18 +2091,18 @@ function PMA_updatePassword($err_url, $username, $hostname)
$GLOBALS['dbi']->tryQuery('SET `old_passwords` = 2;');
}
$sql_query = 'SET PASSWORD FOR \''
. Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\' = '
. $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\' = '
. (($_POST['pma_pw'] == '')
? '\'\''
: $hashing_function . '(\''
. preg_replace('@.@s', '*', $_POST['pma_pw']) . '\')');
$local_query = 'SET PASSWORD FOR \''
. Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\' = '
. $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\' = '
. (($_POST['pma_pw'] == '') ? '\'\'' : $hashing_function
. '(\'' . Util::sqlAddSlashes($_POST['pma_pw']) . '\')');
. '(\'' . $GLOBALS['dbi']->escapeString($_POST['pma_pw']) . '\')');
}
if (!($GLOBALS['dbi']->tryQuery($local_query))) {
@ -2144,12 +2144,12 @@ function PMA_getMessageAndSqlQueryForPrivilegesRevoke($dbname,
$sql_query0 = 'REVOKE ALL PRIVILEGES ON ' . $itemType . ' ' . $db_and_table
. ' FROM \''
. Util::sqlAddSlashes($username) . '\'@\''
. Util::sqlAddSlashes($hostname) . '\';';
. $GLOBALS['dbi']->escapeString($username) . '\'@\''
. $GLOBALS['dbi']->escapeString($hostname) . '\';';
$sql_query1 = 'REVOKE GRANT OPTION ON ' . $itemType . ' ' . $db_and_table
. ' FROM \'' . Util::sqlAddSlashes($username) . '\'@\''
. Util::sqlAddSlashes($hostname) . '\';';
. ' FROM \'' . $GLOBALS['dbi']->escapeString($username) . '\'@\''
. $GLOBALS['dbi']->escapeString($hostname) . '\';';
$GLOBALS['dbi']->query($sql_query0);
if (! $GLOBALS['dbi']->tryQuery($sql_query1)) {
@ -2177,15 +2177,15 @@ function PMA_getRequireClause()
$require = array();
if (! empty($arr['ssl_cipher'])) {
$require[] = "CIPHER '"
. Util::sqlAddSlashes($arr['ssl_cipher']) . "'";
. $GLOBALS['dbi']->escapeString($arr['ssl_cipher']) . "'";
}
if (! empty($arr['x509_issuer'])) {
$require[] = "ISSUER '"
. Util::sqlAddSlashes($arr['x509_issuer']) . "'";
. $GLOBALS['dbi']->escapeString($arr['x509_issuer']) . "'";
}
if (! empty($arr['x509_subject'])) {
$require[] = "SUBJECT '"
. Util::sqlAddSlashes($arr['x509_subject']) . "'";
. $GLOBALS['dbi']->escapeString($arr['x509_subject']) . "'";
}
if (count($require)) {
$require_clause = " REQUIRE " . implode(" AND ", $require);
@ -2387,7 +2387,7 @@ function PMA_getListOfPrivilegesAndComparedPrivileges()
*/
function PMA_getHtmlTableBodyForSpecificDbRoutinePrivs($db, $odd_row, $index_checkbox)
{
$sql_query = 'SELECT * FROM `mysql`.`procs_priv` WHERE Db = \'' . Util::sqlAddSlashes($db) . '\';';
$sql_query = 'SELECT * FROM `mysql`.`procs_priv` WHERE Db = \'' . $GLOBALS['dbi']->escapeString($db) . '\';';
$res = $GLOBALS['dbi']->query($sql_query);
$html_output = '';
while ($row = $GLOBALS['dbi']->fetchAssoc($res)) {
@ -2551,8 +2551,8 @@ function PMA_getHtmlForSpecificTablePrivileges($db, $table)
$sql_query = "SELECT `User`, `Host`, `Db`,"
. " 't' AS `Type`, `Table_name`, `Table_priv`"
. " FROM `mysql`.`tables_priv`"
. " WHERE '" . Util::sqlAddSlashes($db) . "' LIKE `Db`"
. " AND '" . Util::sqlAddSlashes($table) . "' LIKE `Table_name`"
. " WHERE '" . $GLOBALS['dbi']->escapeString($db) . "' LIKE `Db`"
. " AND '" . $GLOBALS['dbi']->escapeString($table) . "' LIKE `Table_name`"
. " AND NOT (`Table_priv` = '' AND Column_priv = '')"
. " ORDER BY `User` ASC, `Host` ASC, `Db` ASC, `Table_priv` ASC;";
$res = $GLOBALS['dbi']->query($sql_query);
@ -2605,7 +2605,7 @@ function PMA_getPrivMap($db)
. "("
. " SELECT " . $listOfPrivs . ", `Db`, 'd' AS `Type`"
. " FROM `mysql`.`db`"
. " WHERE '" . Util::sqlAddSlashes($db) . "' LIKE `Db`"
. " WHERE '" . $GLOBALS['dbi']->escapeString($db) . "' LIKE `Db`"
. " AND NOT (" . $listOfComparedPrivs . ")"
. ")"
. " ORDER BY `User` ASC, `Host` ASC, `Db` ASC;";
@ -3273,9 +3273,9 @@ function PMA_getLinkToDbAndTable($url_dbname, $dbname, $tablename)
function PMA_getUserSpecificRights($username, $hostname, $type, $dbname = '')
{
$user_host_condition = " WHERE `User`"
. " = '" . Util::sqlAddSlashes($username) . "'"
. " = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host`"
. " = '" . Util::sqlAddSlashes($hostname) . "'";
. " = '" . $GLOBALS['dbi']->escapeString($hostname) . "'";
if ($type == 'database') {
$tables_to_search_for_users = array(
@ -3284,12 +3284,12 @@ function PMA_getUserSpecificRights($username, $hostname, $type, $dbname = '')
$dbOrTableName = 'Db';
} elseif ($type == 'table') {
$user_host_condition .= " AND `Db` LIKE '"
. Util::sqlAddSlashes($dbname, true) . "'";
. $GLOBALS['dbi']->escapeString($dbname, true) . "'";
$tables_to_search_for_users = array('columns_priv',);
$dbOrTableName = 'Table_name';
} else { // routine
$user_host_condition .= " AND `Db` LIKE '"
. Util::sqlAddSlashes($dbname, true) . "'";
. $GLOBALS['dbi']->escapeString($dbname, true) . "'";
$tables_to_search_for_users = array('procs_priv',);
$dbOrTableName = 'Routine_name';
}
@ -4020,13 +4020,13 @@ function PMA_updatePrivileges($username, $hostname, $tablename, $dbname, $itemTy
$db_and_table = PMA_wildcardEscapeForGrant($dbname, $tablename);
$sql_query0 = 'REVOKE ALL PRIVILEGES ON ' . $itemType . ' ' . $db_and_table
. ' FROM \'' . Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\';';
. ' FROM \'' . $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\';';
if (! isset($_POST['Grant_priv']) || $_POST['Grant_priv'] != 'Y') {
$sql_query1 = 'REVOKE GRANT OPTION ON ' . $itemType . ' ' . $db_and_table
. ' FROM \'' . Util::sqlAddSlashes($username) . '\'@\''
. Util::sqlAddSlashes($hostname) . '\';';
. ' FROM \'' . $GLOBALS['dbi']->escapeString($username) . '\'@\''
. $GLOBALS['dbi']->escapeString($hostname) . '\';';
} else {
$sql_query1 = '';
}
@ -4038,8 +4038,8 @@ function PMA_updatePrivileges($username, $hostname, $tablename, $dbname, $itemTy
) {
$sql_query2 = 'GRANT ' . join(', ', PMA_extractPrivInfo())
. ' ON ' . $itemType . ' ' . $db_and_table
. ' TO \'' . Util::sqlAddSlashes($username) . '\'@\''
. Util::sqlAddSlashes($hostname) . '\'';
. ' TO \'' . $GLOBALS['dbi']->escapeString($username) . '\'@\''
. $GLOBALS['dbi']->escapeString($hostname) . '\'';
if (strlen($dbname) === 0) {
// add REQUIRE clause
@ -4090,9 +4090,9 @@ function PMA_getDataForChangeOrCopyUser()
if (isset($_REQUEST['change_copy'])) {
$user_host_condition = ' WHERE `User` = '
. "'" . Util::sqlAddSlashes($_REQUEST['old_username']) . "'"
. "'" . $GLOBALS['dbi']->escapeString($_REQUEST['old_username']) . "'"
. ' AND `Host` = '
. "'" . Util::sqlAddSlashes($_REQUEST['old_hostname']) . "';";
. "'" . $GLOBALS['dbi']->escapeString($_REQUEST['old_hostname']) . "';";
$row = $GLOBALS['dbi']->fetchSingleRow(
'SELECT * FROM `mysql`.`user` ' . $user_host_condition
);
@ -4181,8 +4181,8 @@ function PMA_getDataForDeleteUsers($queries)
)
. ' ...';
$queries[] = 'DROP USER \''
. Util::sqlAddSlashes($this_user)
. '\'@\'' . Util::sqlAddSlashes($this_host) . '\';';
. $GLOBALS['dbi']->escapeString($this_user)
. '\'@\'' . $GLOBALS['dbi']->escapeString($this_host) . '\';';
PMA_relationsCleanupUser($this_user);
if (isset($_REQUEST['drop_users_db'])) {
@ -4294,8 +4294,8 @@ function PMA_addUser(
break;
}
$sql = "SELECT '1' FROM `mysql`.`user`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "';";
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "';";
if ($GLOBALS['dbi']->fetchValue($sql) == 1) {
$message = Message::error(__('The user %s already exists!'));
$message->addParam('[em]\'' . $username . '\'@\'' . $hostname . '\'[/em]');
@ -4914,8 +4914,8 @@ function PMA_getHtmlForUserProperties($dbname_is_wildcard,$url_dbname,
);
$sql = "SELECT '1' FROM `mysql`.`user`"
. " WHERE `User` = '" . Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . Util::sqlAddSlashes($hostname) . "';";
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "';";
$user_does_not_exists = (bool) ! $GLOBALS['dbi']->fetchValue($sql);
@ -5018,13 +5018,13 @@ function PMA_getTablePrivsQueriesForChangeOrCopyUser($user_host_condition,
'SELECT `Column_name`, `Column_priv`'
. ' FROM `mysql`.`columns_priv`'
. ' WHERE `User`'
. ' = \'' . Util::sqlAddSlashes($_REQUEST['old_username']) . "'"
. ' = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['old_username']) . "'"
. ' AND `Host`'
. ' = \'' . Util::sqlAddSlashes($_REQUEST['old_username']) . '\''
. ' = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['old_username']) . '\''
. ' AND `Db`'
. ' = \'' . Util::sqlAddSlashes($row['Db']) . "'"
. ' = \'' . $GLOBALS['dbi']->escapeString($row['Db']) . "'"
. ' AND `Table_name`'
. ' = \'' . Util::sqlAddSlashes($row['Table_name']) . "'"
. ' = \'' . $GLOBALS['dbi']->escapeString($row['Table_name']) . "'"
. ';',
null,
PMA\libraries\DatabaseInterface::QUERY_STORE
@ -5072,8 +5072,8 @@ function PMA_getTablePrivsQueriesForChangeOrCopyUser($user_host_condition,
$queries[] = 'GRANT ' . join(', ', $tmp_privs1)
. ' ON ' . Util::backquote($row['Db']) . '.'
. Util::backquote($row['Table_name'])
. ' TO \'' . Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\''
. ' TO \'' . $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\''
. (in_array('Grant', explode(',', $row['Table_priv']))
? ' WITH GRANT OPTION;'
: ';');
@ -5094,9 +5094,9 @@ function PMA_getDbSpecificPrivsQueriesForChangeOrCopyUser(
$queries, $username, $hostname
) {
$user_host_condition = ' WHERE `User`'
. ' = \'' . Util::sqlAddSlashes($_REQUEST['old_username']) . "'"
. ' = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['old_username']) . "'"
. ' AND `Host`'
. ' = \'' . Util::sqlAddSlashes($_REQUEST['old_hostname']) . '\';';
. ' = \'' . $GLOBALS['dbi']->escapeString($_REQUEST['old_hostname']) . '\';';
$res = $GLOBALS['dbi']->query(
'SELECT * FROM `mysql`.`db`' . $user_host_condition
@ -5105,8 +5105,8 @@ function PMA_getDbSpecificPrivsQueriesForChangeOrCopyUser(
while ($row = $GLOBALS['dbi']->fetchAssoc($res)) {
$queries[] = 'GRANT ' . join(', ', PMA_extractPrivInfo($row))
. ' ON ' . Util::backquote($row['Db']) . '.*'
. ' TO \'' . Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\''
. ' TO \'' . $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\''
. ($row['Grant_priv'] == 'Y' ? ' WITH GRANT OPTION;' : ';');
}
$GLOBALS['dbi']->freeResult($res);
@ -5148,7 +5148,7 @@ function PMA_addUserAndCreateDatabase($_error, $real_sql_query, $sql_query,
// Create database with same name and grant all privileges
$q = 'CREATE DATABASE IF NOT EXISTS '
. Util::backquote(
Util::sqlAddSlashes($username)
$GLOBALS['dbi']->escapeString($username)
) . ';';
$sql_query .= $q;
if (! $GLOBALS['dbi']->tryQuery($q)) {
@ -5164,11 +5164,11 @@ function PMA_addUserAndCreateDatabase($_error, $real_sql_query, $sql_query,
$q = 'GRANT ALL PRIVILEGES ON '
. Util::backquote(
Util::escapeMysqlWildcards(
Util::sqlAddSlashes($username)
$GLOBALS['dbi']->escapeString($username)
)
) . '.* TO \''
. Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\';';
. $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\';';
$sql_query .= $q;
if (! $GLOBALS['dbi']->tryQuery($q)) {
$message = Message::rawError($GLOBALS['dbi']->getError());
@ -5180,11 +5180,11 @@ function PMA_addUserAndCreateDatabase($_error, $real_sql_query, $sql_query,
$q = 'GRANT ALL PRIVILEGES ON '
. Util::backquote(
Util::escapeMysqlWildcards(
Util::sqlAddSlashes($username)
$GLOBALS['dbi']->escapeString($username)
) . '\_%'
) . '.* TO \''
. Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\';';
. $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\';';
$sql_query .= $q;
if (! $GLOBALS['dbi']->tryQuery($q)) {
$message = Message::rawError($GLOBALS['dbi']->getError());
@ -5195,10 +5195,10 @@ function PMA_addUserAndCreateDatabase($_error, $real_sql_query, $sql_query,
// Grant all privileges on the specified database to the new user
$q = 'GRANT ALL PRIVILEGES ON '
. Util::backquote(
Util::sqlAddSlashes($dbname)
$GLOBALS['dbi']->escapeString($dbname)
) . '.* TO \''
. Util::sqlAddSlashes($username)
. '\'@\'' . Util::sqlAddSlashes($hostname) . '\';';
. $GLOBALS['dbi']->escapeString($username)
. '\'@\'' . $GLOBALS['dbi']->escapeString($hostname) . '\';';
$sql_query .= $q;
if (! $GLOBALS['dbi']->tryQuery($q)) {
$message = Message::rawError($GLOBALS['dbi']->getError());
@ -5263,9 +5263,9 @@ function PMA_checkIfMariaDBPwdCheckPluginActive()
*/
function PMA_getSqlQueriesForDisplayAndAddUser($username, $hostname, $password)
{
$slashedUsername = Util::sqlAddSlashes($username);
$slashedHostname = Util::sqlAddSlashes($hostname);
$slashedPassword = Util::sqlAddSlashes($password);
$slashedUsername = $GLOBALS['dbi']->escapeString($username);
$slashedHostname = $GLOBALS['dbi']->escapeString($hostname);
$slashedPassword = $GLOBALS['dbi']->escapeString($password);
$serverType = Util::getServerType();
$create_user_stmt = sprintf(

2
libraries/server_status_monitor.lib.php
View File

@ -744,7 +744,7 @@ function PMA_getSuspensionPoints($lastChar)
function PMA_getJsonForLoggingVars()
{
if (isset($_REQUEST['varName']) && isset($_REQUEST['varValue'])) {
$value = PMA\libraries\Util::sqlAddSlashes($_REQUEST['varValue']);
$value = $GLOBALS['dbi']->escapeString($_REQUEST['varValue']);
if (! is_numeric($value)) {
$value="'" . $value . "'";
}

12
libraries/server_user_groups.lib.php
View File

@ -24,7 +24,7 @@ function PMA_getHtmlForListingUsersofAGroup($userGroup)
$usersTable = PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['users']);
$sql_query = "SELECT `username` FROM " . $usersTable
. " WHERE `usergroup`='" . PMA\libraries\Util::sqlAddSlashes($userGroup)
. " WHERE `usergroup`='" . $GLOBALS['dbi']->escapeString($userGroup)
. "'";
$result = PMA_queryAsControlUser($sql_query, false);
if ($result) {
@ -187,11 +187,11 @@ function PMA_deleteUserGroup($userGroup)
$groupTable = PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['usergroups']);
$sql_query = "DELETE FROM " . $userTable
. " WHERE `usergroup`='" . PMA\libraries\Util::sqlAddSlashes($userGroup)
. " WHERE `usergroup`='" . $GLOBALS['dbi']->escapeString($userGroup)
. "'";
PMA_queryAsControlUser($sql_query, true);
$sql_query = "DELETE FROM " . $groupTable
. " WHERE `usergroup`='" . PMA\libraries\Util::sqlAddSlashes($userGroup)
. " WHERE `usergroup`='" . $GLOBALS['dbi']->escapeString($userGroup)
. "'";
PMA_queryAsControlUser($sql_query, true);
}
@ -250,7 +250,7 @@ function PMA_getHtmlToEditUserGroup($userGroup = null)
$groupTable = PMA\libraries\Util::backquote($cfgRelation['db'])
. "." . PMA\libraries\Util::backquote($cfgRelation['usergroups']);
$sql_query = "SELECT * FROM " . $groupTable
. " WHERE `usergroup`='" . PMA\libraries\Util::sqlAddSlashes($userGroup)
. " WHERE `usergroup`='" . $GLOBALS['dbi']->escapeString($userGroup)
. "'";
$result = PMA_queryAsControlUser($sql_query, false);
if ($result) {
@ -337,7 +337,7 @@ function PMA_editUserGroup($userGroup, $new = false)
if (! $new) {
$sql_query = "DELETE FROM " . $groupTable
. " WHERE `usergroup`='" . PMA\libraries\Util::sqlAddSlashes($userGroup)
. " WHERE `usergroup`='" . $GLOBALS['dbi']->escapeString($userGroup)
. "';";
PMA_queryAsControlUser($sql_query, true);
}
@ -353,7 +353,7 @@ function PMA_editUserGroup($userGroup, $new = false)
}
$tabName = $tabGroupName . '_' . $tab;
$allowed = isset($_REQUEST[$tabName]) && $_REQUEST[$tabName] == 'Y';
$sql_query .= "('" . PMA\libraries\Util::sqlAddSlashes($userGroup) . "', '" . $tabName . "', '"
$sql_query .= "('" . $GLOBALS['dbi']->escapeString($userGroup) . "', '" . $tabName . "', '"
. ($allowed ? "Y" : "N") . "')";
$first = false;
}

10
libraries/tracking.lib.php
View File

@ -246,10 +246,10 @@ function PMA_getListOfVersionsOfTable()
$sql_query = " SELECT * FROM " .
PMA\libraries\Util::backquote($cfgRelation['db']) . "." .
PMA\libraries\Util::backquote($cfgRelation['tracking']) .
" WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($_REQUEST['db']) .
" WHERE db_name = '" . $GLOBALS['dbi']->escapeString($_REQUEST['db']) .
"' " .
" AND table_name = '" .
PMA\libraries\Util::sqlAddSlashes($_REQUEST['table']) . "' " .
$GLOBALS['dbi']->escapeString($_REQUEST['table']) . "' " .
" ORDER BY version DESC ";
return PMA_queryAsControlUser($sql_query);
@ -409,7 +409,7 @@ function PMA_getSQLResultForSelectableTables()
$sql_query = " SELECT DISTINCT db_name, table_name FROM " .
PMA\libraries\Util::backquote($cfgRelation['db']) . "." .
PMA\libraries\Util::backquote($cfgRelation['tracking']) .
" WHERE db_name = '" . PMA\libraries\Util::sqlAddSlashes($GLOBALS['db']) .
" WHERE db_name = '" . $GLOBALS['dbi']->escapeString($GLOBALS['db']) .
"' " .
" ORDER BY db_name, table_name";
@ -1654,9 +1654,9 @@ function PMA_displayTrackedTables(
PMA\libraries\Util::backquote($cfgRelation['db']) . '.' .
PMA\libraries\Util::backquote($cfgRelation['tracking']) .
' WHERE `db_name` = \''
. PMA\libraries\Util::sqlAddSlashes($_REQUEST['db'])
. $GLOBALS['dbi']->escapeString($_REQUEST['db'])
. '\' AND `table_name` = \''
. PMA\libraries\Util::sqlAddSlashes($table_name)
. $GLOBALS['dbi']->escapeString($table_name)
. '\' AND `version` = \'' . $version_number . '\'';
$table_result = PMA_queryAsControlUser($table_query);

42
libraries/transformations.lib.php
View File

@ -236,8 +236,8 @@ function PMA_getMIME($db, $table, $strict = false, $fullName = false)
`input_transformation_options`
FROM ' . PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['column_info']) . '
WHERE `db_name` = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'
AND `table_name` = \'' . PMA\libraries\Util::sqlAddSlashes($table) . '\'
WHERE `db_name` = \'' . $GLOBALS['dbi']->escapeString($db) . '\'
AND `table_name` = \'' . $GLOBALS['dbi']->escapeString($table) . '\'
AND ( `mimetype` != \'\'' . (!$strict ? '
OR `transformation` != \'\'
OR `transformation_options` != \'\'
@ -331,9 +331,9 @@ function PMA_setMIME($db, $table, $key, $mimetype, $transformation,
`comment`
FROM ' . PMA\libraries\Util::backquote($cfgRelation['db']) . '.'
. PMA\libraries\Util::backquote($cfgRelation['column_info']) . '
WHERE `db_name` = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'
AND `table_name` = \'' . PMA\libraries\Util::sqlAddSlashes($table) . '\'
AND `column_name` = \'' . PMA\libraries\Util::sqlAddSlashes($key) . '\'';
WHERE `db_name` = \'' . $GLOBALS['dbi']->escapeString($db) . '\'
AND `table_name` = \'' . $GLOBALS['dbi']->escapeString($table) . '\'
AND `column_name` = \'' . $GLOBALS['dbi']->escapeString($key) . '\'';
$test_rs = PMA_queryAsControlUser(
$test_qry, true, PMA\libraries\DatabaseInterface::QUERY_STORE
@ -354,25 +354,25 @@ function PMA_setMIME($db, $table, $key, $mimetype, $transformation,
. PMA\libraries\Util::backquote($cfgRelation['column_info'])
. ' SET '
. '`mimetype` = \''
. PMA\libraries\Util::sqlAddSlashes($mimetype) . '\', '
. $GLOBALS['dbi']->escapeString($mimetype) . '\', '
. '`transformation` = \''
. PMA\libraries\Util::sqlAddSlashes($transformation) . '\', '
. $GLOBALS['dbi']->escapeString($transformation) . '\', '
. '`transformation_options` = \''
. PMA\libraries\Util::sqlAddSlashes($transformationOpts) . '\', '
. $GLOBALS['dbi']->escapeString($transformationOpts) . '\', '
. '`input_transformation` = \''
. PMA\libraries\Util::sqlAddSlashes($inputTransform) . '\', '
. $GLOBALS['dbi']->escapeString($inputTransform) . '\', '
. '`input_transformation_options` = \''
. PMA\libraries\Util::sqlAddSlashes($inputTransformOpts) . '\'';
. $GLOBALS['dbi']->escapeString($inputTransformOpts) . '\'';
} else {
$upd_query = 'DELETE FROM '
. PMA\libraries\Util::backquote($cfgRelation['db'])
. '.' . PMA\libraries\Util::backquote($cfgRelation['column_info']);
}
$upd_query .= '
WHERE `db_name` = \'' . PMA\libraries\Util::sqlAddSlashes($db) . '\'
AND `table_name` = \'' . PMA\libraries\Util::sqlAddSlashes($table)
WHERE `db_name` = \'' . $GLOBALS['dbi']->escapeString($db) . '\'
AND `table_name` = \'' . $GLOBALS['dbi']->escapeString($table)
. '\'
AND `column_name` = \'' . PMA\libraries\Util::sqlAddSlashes($key)
AND `column_name` = \'' . $GLOBALS['dbi']->escapeString($key)
. '\'';
} elseif (strlen($mimetype) > 0
|| strlen($transformation) > 0
@ -386,14 +386,14 @@ function PMA_setMIME($db, $table, $key, $mimetype, $transformation,
. 'transformation, transformation_options, '
. 'input_transformation, input_transformation_options) '
. ' VALUES('
. '\'' . PMA\libraries\Util::sqlAddSlashes($db) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($table) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($key) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($mimetype) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($transformation) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($transformationOpts) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($inputTransform) . '\','
. '\'' . PMA\libraries\Util::sqlAddSlashes($inputTransformOpts) . '\')';
. '\'' . $GLOBALS['dbi']->escapeString($db) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($table) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($key) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($mimetype) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($transformation) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($transformationOpts) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($inputTransform) . '\','
. '\'' . $GLOBALS['dbi']->escapeString($inputTransformOpts) . '\')';
}
if (isset($upd_query)) {

12
libraries/user_preferences.lib.php
View File

@ -65,7 +65,7 @@ function PMA_loadUserprefs()
$query = 'SELECT `config_data`, UNIX_TIMESTAMP(`timevalue`) ts'
. ' FROM ' . $query_table
. ' WHERE `username` = \''
. PMA\libraries\Util::sqlAddSlashes($cfgRelation['user'])
. $GLOBALS['dbi']->escapeString($cfgRelation['user'])
. '\'';
$row = $GLOBALS['dbi']->fetchSingleRow($query, 'ASSOC', $GLOBALS['controllink']);
@ -105,7 +105,7 @@ function PMA_saveUserprefs(array $config_array)
. PMA\libraries\Util::backquote($cfgRelation['userconfig']);
$query = 'SELECT `username` FROM ' . $query_table
. ' WHERE `username` = \''
. PMA\libraries\Util::sqlAddSlashes($cfgRelation['user'])
. $GLOBALS['dbi']->escapeString($cfgRelation['user'])
. '\'';
$has_config = $GLOBALS['dbi']->fetchValue(
@ -115,17 +115,17 @@ function PMA_saveUserprefs(array $config_array)
if ($has_config) {
$query = 'UPDATE ' . $query_table
. ' SET `timevalue` = NOW(), `config_data` = \''
. PMA\libraries\Util::sqlAddSlashes($config_data)
. $GLOBALS['dbi']->escapeString($config_data)
. '\''
. ' WHERE `username` = \''
. PMA\libraries\Util::sqlAddSlashes($cfgRelation['user'])
. $GLOBALS['dbi']->escapeString($cfgRelation['user'])
. '\'';
} else {
$query = 'INSERT INTO ' . $query_table
. ' (`username`, `timevalue`,`config_data`) '
. 'VALUES (\''
. PMA\libraries\Util::sqlAddSlashes($cfgRelation['user']) . '\', NOW(), '
. '\'' . PMA\libraries\Util::sqlAddSlashes($config_data) . '\')';
. $GLOBALS['dbi']->escapeString($cfgRelation['user']) . '\', NOW(), '
. '\'' . $GLOBALS['dbi']->escapeString($config_data) . '\')';
}
if (isset($_SESSION['cache'][$cache_key]['userprefs'])) {
unset($_SESSION['cache'][$cache_key]['userprefs']);

4
phpunit.xml.dist
View File

@ -27,9 +27,9 @@
<directory suffix="_test.php">test/libraries/rte</directory>
<directory suffix="_test.php">test/libraries</directory>
</testsuite>
<testsuite name="Selenium">
<!-- <testsuite name="Selenium">
<directory suffix="Test.php">test/selenium</directory>
</testsuite>
</testsuite> -->
</testsuites>
<logging>

28
test/classes/DbSearchTest.php
View File

@ -39,6 +39,22 @@ class DbSearchTest extends PMATestCase
$this->object = new DbSearch('pma_test');
$GLOBALS['server'] = 0;
$GLOBALS['db'] = 'pma';
//mock DBI
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())
->method('getColumns')
->with('pma', 'table1')
->will($this->returnValue(array()));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
}
/**
@ -76,18 +92,6 @@ class DbSearchTest extends PMATestCase
*/
public function testGetSearchSqls()
{
//mock DBI
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())
->method('getColumns')
->with('pma', 'table1')
->will($this->returnValue(array()));
$GLOBALS['dbi'] = $dbi;
$this->assertEquals(
array (
'select_columns' => 'SELECT * FROM `pma`.`table1` WHERE FALSE',

3
test/classes/TableTest.php
View File

@ -279,6 +279,9 @@ class TableTest extends PMATestCase
$dbi->expects($this->any())->method('fetchRow')
->will($this->returnValue(false));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
}

8
test/classes/ThemeManagerTest.php
View File

@ -33,6 +33,14 @@ class ThemeManagerTest extends PMATestCase
$GLOBALS['server'] = 99;
$GLOBALS['PMA_Config'] = new PMA\libraries\Config();
$GLOBALS['collation_connection'] = 'utf8_general_ci';
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$cfg['dbi'] = $dbi;
}
/**

61
test/classes/TrackerTest.php
View File

@ -47,6 +47,14 @@ class TrackerTest extends PMATestCase
'db' => 'pmadb',
'tracking' => 'tracking'
);
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$cfg['dbi'] = $dbi;
}
/**
* Test for Tracker::enable
@ -318,6 +326,9 @@ class TrackerTest extends PMATestCase
$dbi->expects($this->any())->method('query')
->will($this->returnValueMap($queryResults));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->assertEquals(
'executed',
@ -348,6 +359,8 @@ class TrackerTest extends PMATestCase
->method('query')
->with($sql_query)
->will($this->returnValue('executed'));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->assertEquals(
@ -400,6 +413,9 @@ class TrackerTest extends PMATestCase
->with($expectedMainQuery, null, 0, false)
->will($this->returnValue("executed"));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->assertEquals(
'executed',
@ -444,6 +460,9 @@ class TrackerTest extends PMATestCase
->with($sql_query, null, 0, false)
->will($this->returnValue("executed"));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
if ($type == null) {
@ -516,15 +535,18 @@ class TrackerTest extends PMATestCase
" AND `table_name` = 'pma_table' " .
" AND `version` = '1.0' ";
$dbi->expects($this->at(0))
->method('query')
->with($sql_query_1, null, 0, false)
->will($this->returnValue("executed_1"));
$dbi->method('query')
->will(
$this->returnValueMap(
array(
array($sql_query_1, null, 0, false, "executed_1"),
array($sql_query_2, null, 0, false, "executed_2")
)
)
);
$dbi->expects($this->at(1))
->method('query')
->with($sql_query_2, null, 0, false)
->will($this->returnValue("executed_2"));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -587,28 +609,33 @@ class TrackerTest extends PMATestCase
*/
public function testGetTrackedData($fetchArrayReturn, $expectedArray)
{
$sql_query = " SELECT * FROM `pmadb`.`tracking`" .
" WHERE `db_name` = 'pma\\'db' " .
" AND `table_name` = 'pma\\'table' " .
" AND `version` = '1.0' " .
" ORDER BY `version` DESC LIMIT 1";
$GLOBALS['controllink'] = null;
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('query')
->with($sql_query, null, 0, false)
->will($this->returnValue("executed_1"));
$dbi->expects($this->at(1))
$dbi->expects($this->once())
->method('fetchAssoc')
->with("executed_1")
->will($this->returnValue($fetchArrayReturn));
$dbi->expects($this->any())
->method('escapeString')
->will(
$this->returnValueMap(
array(
array("pma'db", "pma\'db"),
array("pma'table", "pma\'table"),
array("1.0", "1.0"),
)
)
);
$GLOBALS['dbi'] = $dbi;
$result = Tracker::getTrackedData("pma'db", "pma'table", "1.0");

2
test/classes/controllers/TableSearchControllerTest.php
View File

@ -83,6 +83,8 @@ class TableSearchControllerTest extends PMATestCase
$dbi->expects($this->any())->method('fetchValue')
->will($this->returnValue($show_create_table));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;

15
test/classes/navigation/NavigationTest.php
View File

@ -69,6 +69,9 @@ class NavigationTest extends PMATestCase
$dbi->expects($this->once())
->method('tryQuery')
->with($expectedQuery);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->object->hideNavigationItem('itemName', 'itemType', 'db');
}
@ -90,6 +93,9 @@ class NavigationTest extends PMATestCase
$dbi->expects($this->once())
->method('tryQuery')
->with($expectedQuery);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->object->unhideNavigationItem('itemName', 'itemType', 'db');
}
@ -112,7 +118,7 @@ class NavigationTest extends PMATestCase
->method('tryQuery')
->with($expectedQuery)
->will($this->returnValue(true));
$dbi->expects($this->at(1))
$dbi->expects($this->at(3))
->method('fetchArray')
->will(
$this->returnValue(
@ -122,7 +128,7 @@ class NavigationTest extends PMATestCase
)
)
);
$dbi->expects($this->at(2))
$dbi->expects($this->at(4))
->method('fetchArray')
->will(
$this->returnValue(
@ -132,11 +138,14 @@ class NavigationTest extends PMATestCase
)
)
);
$dbi->expects($this->at(3))
$dbi->expects($this->at(5))
->method('fetchArray')
->will($this->returnValue(false));
$dbi->expects($this->once())
->method('freeResult');
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$html = $this->object->getItemUnhideDialog('db');

43
test/classes/navigation/NodeTest.php
View File

@ -372,6 +372,8 @@ class NodeTest extends PMATestCase
$dbi->expects($this->once())
->method('fetchResult')
->with($expectedSql);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$node->getData('', $pos);
}
@ -407,6 +409,9 @@ class NodeTest extends PMATestCase
$dbi->expects($this->once())
->method('fetchResult')
->with($expectedSql);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$node->getData('', $pos);
}
@ -437,27 +442,18 @@ class NodeTest extends PMATestCase
->method('tryQuery')
->with("SHOW DATABASES WHERE TRUE AND `Database` LIKE '%db%' ")
->will($this->returnValue(true));
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(3))
->method('fetchArray')
->will(
$this->returnValue(
array(
'0' => 'db'
)
)
->willReturnOnConsecutiveCalls(
array(
'0' => 'db'
),
array(
'0' => 'aa_db'
),
false
);
$dbi->expects($this->at(2))
->method('fetchArray')
->will(
$this->returnValue(
array(
'0' => 'aa_db'
)
)
);
$dbi->expects($this->at(3))
->method('fetchArray')
->will($this->returnValue(false));
$dbi->expects($this->once())
->method('fetchResult')
->with(
@ -465,6 +461,9 @@ class NodeTest extends PMATestCase
. " LOCATE('db_', CONCAT(`Database`, '_')) = 1"
. " OR LOCATE('aa_', CONCAT(`Database`, '_')) = 1 )"
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$node->getData('', $pos, 'db');
}
@ -552,6 +551,9 @@ class NodeTest extends PMATestCase
$dbi->expects($this->once())
->method('tryQuery')
->with("SHOW DATABASES WHERE TRUE ");
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$node->getPresence();
@ -562,6 +564,9 @@ class NodeTest extends PMATestCase
$dbi->expects($this->once())
->method('tryQuery')
->with("SHOW DATABASES WHERE TRUE AND `Database` LIKE '%dbname%' ");
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$node->getPresence('', 'dbname');
}

60
test/classes/plugin/export/ExportHtmlwordTest.php
View File

@ -478,20 +478,15 @@ class ExportHtmlwordTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will($this->returnValue(array()));
$dbi->expects($this->at(6))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fieldname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
->willReturnOnConsecutiveCalls(
array(),
array(
'fieldname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);
@ -526,6 +521,8 @@ class ExportHtmlwordTest extends PMATestCase
)
)
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -572,29 +569,20 @@ class ExportHtmlwordTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fieldname' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
)
->willReturnOnConsecutiveCalls(
array(
'fieldname' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
)
)
);
$dbi->expects($this->at(6))
->method('fetchResult')
->will(
$this->returnValue(
array(
'field' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
),
array(
'field' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);
@ -630,6 +618,8 @@ class ExportHtmlwordTest extends PMATestCase
)
)
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -699,6 +689,8 @@ class ExportHtmlwordTest extends PMATestCase
)
)
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;

58
test/classes/plugin/export/ExportLatexTest.php
View File

@ -692,20 +692,15 @@ class ExportLatexTest extends PMATestCase
->with('database', '')
->will($this->returnValue($keys));
$dbi->expects($this->at(2))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will($this->returnValue(array()));
$dbi->expects($this->at(7))
->method('fetchResult')
->will(
$this->returnValue(
array(
'name1' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'testmimetype_'
)
->willReturnOnConsecutiveCalls(
array(),
array(
'name1' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'testmimetype_'
)
)
);
@ -810,30 +805,21 @@ class ExportLatexTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(2))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will(
$this->returnValue(
array(
'name1' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
),
'foreign_keys_data' => array()
)
)
);
$dbi->expects($this->at(7))
->method('fetchResult')
->will(
$this->returnValue(
array(
'field' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
->willReturnOnConsecutiveCalls(
array(
'name1' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
),
'foreign_keys_data' => array()
),
array(
'field' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);

22
test/classes/plugin/export/ExportOdsTest.php
View File

@ -314,13 +314,18 @@ class ExportOdsTest extends PMATestCase
->with(true)
->will($this->returnValue($flags));
$dbi->expects($this->at(4))
$dbi->expects($this->exactly(8))
->method('fieldFlags')
->will($this->returnValue('BINARYTEST'));
$dbi->expects($this->at(5))
->method('fieldFlags')
->will($this->returnValue('binary'));
->willReturnOnConsecutiveCalls(
'BINARYTEST',
'binary',
'',
'',
'',
'',
'',
''
);
$dbi->expects($this->once())
->method('query')
@ -344,11 +349,6 @@ class ExportOdsTest extends PMATestCase
)
);
$dbi->expects($this->at(12))
->method('fetchRow')
->with(true)
->will($this->returnValue(null));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['mediawiki_caption'] = true;
$GLOBALS['mediawiki_headers'] = true;

54
test/classes/plugin/export/ExportOdtTest.php
View File

@ -689,20 +689,15 @@ class ExportOdtTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will($this->returnValue(array()));
$dbi->expects($this->at(6))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fieldname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
->willReturnOnConsecutiveCalls(
array(),
array(
'fieldname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);
@ -795,29 +790,20 @@ class ExportOdtTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fieldname' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
)
->willReturnOnConsecutiveCalls(
array(
'fieldname' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
)
)
);
$dbi->expects($this->at(6))
->method('fetchResult')
->will(
$this->returnValue(
array(
'field' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
),
array(
'field' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);

231
test/classes/plugin/export/ExportSqlTest.php
View File

@ -89,6 +89,9 @@ class ExportSqlTest extends PMATestCase
->method('getCompatibilities')
->will($this->returnValue(array('v1', 'v2')));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['plugin_param']['export_type'] = 'server';
$GLOBALS['plugin_param']['single_table'] = false;
@ -572,6 +575,8 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->once())
->method('getDbCollation')
@ -610,6 +615,8 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->once())
->method('getDbCollation')
@ -684,18 +691,8 @@ class ExportSqlTest extends PMATestCase
*
* @return void
*/
public function testExportEventsWithNewerMySQLVersion()
public function testExportEvents()
{
$restoreMySQLVersion = "PMANORESTORE";
if (! PMA_HAS_RUNKIT) {
$this->markTestSkipped(
'Cannot redefine constant. Missing runkit extension'
);
} else {
$restoreMySQLVersion = PMA_MYSQL_INT_VERSION;
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', 50101);
}
$GLOBALS['crlf'] = "\n";
$GLOBALS['sql_structure_or_data'] = 'structure';
@ -713,15 +710,18 @@ class ExportSqlTest extends PMATestCase
)
->will($this->returnValue(array('f1', 'f2')));
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('getDefinition')
->with('db', 'EVENT', 'f1')
->will($this->returnValue('f1event'));
$dbi->expects($this->at(2))
->method('getDefinition')
->with('db', 'EVENT', 'f2')
->will($this->returnValue('f2event'));
->will(
$this->returnValueMap(
array(
array('db', 'EVENT', 'f1', null, 'f1event'),
array('db', 'EVENT', 'f2', null, 'f2event')
)
)
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -750,10 +750,6 @@ class ExportSqlTest extends PMATestCase
"f2event$$\n",
$result
);
if ($restoreMySQLVersion !== "PMANORESTORE") {
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', $restoreMySQLVersion);
}
}
/**
@ -761,19 +757,8 @@ class ExportSqlTest extends PMATestCase
*
* @return void
*/
public function testExportDBFooterWithOlderMySQLVersion()
public function testExportDBFooter()
{
$restoreMySQLVersion = "PMANORESTORE";
if (! PMA_HAS_RUNKIT) {
$this->markTestSkipped(
'Cannot redefine constant. Missing runkit extension'
);
} else {
$restoreMySQLVersion = PMA_MYSQL_INT_VERSION;
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', 50100);
}
$GLOBALS['crlf'] = "\n";
$GLOBALS['sql_constraints'] = "SqlConstraints";
$GLOBALS['sql_structure_or_data'] = 'structure';
@ -782,6 +767,8 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -795,10 +782,6 @@ class ExportSqlTest extends PMATestCase
'SqlConstraints',
$result
);
if ($restoreMySQLVersion !== "PMANORESTORE") {
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', $restoreMySQLVersion);
}
}
/**
@ -814,6 +797,8 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->once())
->method('getColumnsFull')
@ -852,8 +837,10 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->at(0))
$dbi->expects($this->any(0))
->method('getColumns')
->with('db', 'view')
->will(
@ -871,22 +858,6 @@ class ExportSqlTest extends PMATestCase
)
);
$dbi->expects($this->at(1))
->method('getColumns')
->with('db', 'view')
->will(
$this->returnValue(
array(
'cname' => array(
'Type' => 'char',
'Collation' => 'utf-8',
'Null' => 'YES',
'Comment' => 'cmt',
'Field' => 'fname'
)
)
)
);
$GLOBALS['dbi'] = $dbi;
$GLOBALS['sql_compatibility'] = 'MSSQL';
@ -905,6 +876,31 @@ class ExportSqlTest extends PMATestCase
// case 2
unset($GLOBALS['sql_compatibility']);
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->any())
->method('getColumns')
->with('db', 'view')
->will(
$this->returnValue(
array(
'cname' => array(
'Type' => 'char',
'Collation' => 'utf-8',
'Null' => 'YES',
'Comment' => 'cmt',
'Field' => 'fname'
)
)
)
);
$GLOBALS['dbi'] = $dbi;
$result = $method->invoke(
$this->object, 'db', 'view', "\n", false
);
@ -945,12 +941,8 @@ class ExportSqlTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->any())
->method('query')
->with(
'SHOW TABLE STATUS FROM `db` WHERE Name = \'table\'', null,
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue('res'));
$dbi->expects($this->never())
@ -959,7 +951,7 @@ class ExportSqlTest extends PMATestCase
$dbi->expects($this->once())
->method('numRows')
->with('res')
->will($this->returnValue(2));
->will($this->returnValue(1));
$dbi->expects($this->any())
->method('fetchValue')
@ -977,11 +969,6 @@ class ExportSqlTest extends PMATestCase
->with('res')
->will($this->returnValue($tmpres));
$dbi->expects($this->at(5))
->method('query')
->with('SET SQL_QUOTE_SHOW_CREATE = 1')
->will($this->returnValue('res'));
$dbi->expects($this->once())
->method('tryQuery')
->with('SHOW CREATE TABLE `db`.`table`')
@ -1007,14 +994,20 @@ class ExportSqlTest extends PMATestCase
") ENGINE=InnoDB AUTO_INCREMENT=16050 DEFAULT CHARSET=utf8\n"
);
$dbi->expects($this->once())
$dbi->expects($this->exactly(1))
->method('fetchRow')
->with('res')
->will($this->returnValue($row));
->will(
$this->returnValueMap(
array(
array('res', $row)
)
)
);
$dbi->expects($this->once())
->method('getTable')
->will($this->returnValue(new Table('table', 'db')));
->will($this->returnValue(new Table('table', 'db', $dbi)));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['cfg']['Server']['DisableIS'] = false;
@ -1116,12 +1109,8 @@ class ExportSqlTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->any())
->method('query')
->with(
'SHOW TABLE STATUS FROM `db` WHERE Name = \'table\'', null,
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue('res'));
$dbi->expects($this->never())
@ -1148,11 +1137,6 @@ class ExportSqlTest extends PMATestCase
->with('res')
->will($this->returnValue($tmpres));
$dbi->expects($this->at(5))
->method('query')
->with('SET SQL_QUOTE_SHOW_CREATE = 0')
->will($this->returnValue('res'));
$dbi->expects($this->once())
->method('tryQuery')
->with('SHOW CREATE TABLE `db`.`table`')
@ -1164,7 +1148,10 @@ class ExportSqlTest extends PMATestCase
$dbi->expects($this->once())
->method('getTable')
->will($this->returnValue(new Table('table', 'db')));
->will($this->returnValue(new Table('table', 'db', $dbi)));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['cfg']['Server']['DisableIS'] = false;
@ -1202,32 +1189,27 @@ class ExportSqlTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will(
$this->returnValue(
array(
'foo' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
)
->willReturnOnConsecutiveCalls(
array(
'foo' => array(
'foreign_table' => 'ftable',
'foreign_field' => 'ffield'
)
),
array(
'fieldname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);
$dbi->expects($this->at(1))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fieldname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
)
);
$GLOBALS['dbi'] = $dbi;
$method = new ReflectionMethod('PMA\libraries\plugins\export\ExportSql', '_getTableComments');
@ -1263,6 +1245,8 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->once())
->method('getTriggers')
@ -1375,6 +1359,8 @@ class ExportSqlTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->once())
->method('getColumns')
@ -1496,14 +1482,14 @@ class ExportSqlTest extends PMATestCase
->with('res')
->will($this->returnValue(5));
$dbi->expects($this->at(11))
$dbi->expects($this->exactly(2))
->method('fetchRow')
->with('res')
->will(
$this->returnValue(
array(null, 'test', '10', '6', "\x00\x0a\x0d\x1a")
)
->willReturnOnConsecutiveCalls(
array(null, 'test', '10', '6', "\x00\x0a\x0d\x1a"),
null
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$_table = $this->getMockBuilder('PMA\libraries\Table')
->disableOriginalConstructor()
@ -1522,6 +1508,7 @@ class ExportSqlTest extends PMATestCase
$GLOBALS['dbi'] = $dbi;
$GLOBALS['sql_compatibility'] = 'MSSQL';
$GLOBALS['sql_backquotes'] = true;
$GLOBALS['sql_max_query_size'] = 50000;
$GLOBALS['sql_views_as_tables'] = true;
$GLOBALS['sql_type'] = 'INSERT';
$GLOBALS['sql_delayed'] = ' DELAYED';
@ -1626,13 +1613,11 @@ class ExportSqlTest extends PMATestCase
->with('res')
->will($this->returnValue(2));
$dbi->expects($this->at(8))
$dbi->expects($this->exactly(2))
->method('fetchRow')
->with('res')
->will(
$this->returnValue(
array(null, null)
)
->willReturnOnConsecutiveCalls(
array(null, null),
null
);
$_table = $this->getMockBuilder('PMA\libraries\Table')
@ -1648,6 +1633,8 @@ class ExportSqlTest extends PMATestCase
$dbi->expects($this->any())
->method('getTable')
->will($this->returnValue($_table));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['sql_compatibility'] = 'MSSQL';
@ -1700,12 +1687,17 @@ class ExportSqlTest extends PMATestCase
$dbi->expects($this->any())
->method('getTable')
->will($this->returnValue($_table));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['cfg']['Server']['DisableIS'] = false;
$GLOBALS['sql_views_as_tables'] = false;
$GLOBALS['sql_include_comments'] = true;
$GLOBALS['crlf'] = "\n";
$oldVal = isset($GLOBALS['sql_compatibility']) ? $GLOBALS['sql_compatibility'] : '';
$GLOBALS['sql_compatibility'] = 'NONE';
$GLOBALS['sql_backquotes'] = true;
ob_start();
$this->assertTrue(
@ -1714,7 +1706,7 @@ class ExportSqlTest extends PMATestCase
$result = ob_get_clean();
$this->assertContains(
"-- VIEW tbl\n",
"-- VIEW `tbl`\n",
$result
);
@ -1722,6 +1714,9 @@ class ExportSqlTest extends PMATestCase
"-- Data: None\n",
$result
);
// reset
$GLOBALS['sql_compatibility'] = $oldVal;
}
/**
@ -1752,6 +1747,8 @@ class ExportSqlTest extends PMATestCase
$dbi->expects($this->any())
->method('getTable')
->will($this->returnValue($_table));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['cfg']['Server']['DisableIS'] = false;

38
test/classes/plugin/export/ExportTexytextTest.php
View File

@ -363,6 +363,7 @@ class ExportTexytextTest extends PMATestCase
$this->object = $this->getMockBuilder('PMA\libraries\plugins\export\ExportTexytext')
->setMethods(array('formatOneColumnDefinition'))
->getMock();
$GLOBALS['controllink'] = null;
// case 1
@ -386,20 +387,25 @@ class ExportTexytextTest extends PMATestCase
->with('db', 'table')
->will($this->returnValue($keys));
$dbi->expects($this->at(2))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fname' => array(
'foreign_table' => '<ftable',
'foreign_field' => 'ffield>'
)
->willReturnOnConsecutiveCalls(
array(
'fname' => array(
'foreign_table' => '<ftable',
'foreign_field' => 'ffield>'
)
),
array(
'fname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
);
$dbi->expects($this->at(3))
$dbi->expects($this->once())
->method('fetchValue')
->will(
$this->returnValue(
@ -407,20 +413,6 @@ class ExportTexytextTest extends PMATestCase
)
);
$dbi->expects($this->at(5))
->method('fetchResult')
->will(
$this->returnValue(
array(
'fname' => array(
'values' => 'test-',
'transformation' => 'testfoo',
'mimetype' => 'test<'
)
)
)
);
$columns = array(
'Field' => 'fname',
'Comment' => 'comm'

132
test/classes/plugin/export/ExportXmlTest.php
View File

@ -233,29 +233,15 @@ class ExportXmlTest extends PMATestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->exactly(3))
->method('fetchResult')
->with(
'SELECT `DEFAULT_CHARACTER_SET_NAME`, `DEFAULT_COLLATION_NAME`'
. ' FROM `information_schema`.`SCHEMATA` WHERE `SCHEMA_NAME`'
. ' = \'d<"b\' LIMIT 1'
)
->will($this->returnValue($result));
->willReturnOnConsecutiveCalls(
$result,
$result,
false
);
$dbi->expects($this->at(1))
->method('fetchResult')
->with(
'SHOW CREATE TABLE `d<"b`.`table`',
0
)
->will($this->returnValue($result));
// isView
$dbi->expects($this->at(2))
->method('fetchResult')
->will($this->returnValue(false));
$dbi->expects($this->at(3))
$dbi->expects($this->once())
->method('getTriggers')
->with('d<"b', 'table')
->will(
@ -269,49 +255,29 @@ class ExportXmlTest extends PMATestCase
)
);
$dbi->expects($this->at(4))
$dbi->expects($this->exactly(2))
->method('getProceduresOrFunctions')
->with('d<"b', 'FUNCTION')
->will(
$this->returnValue(
array(
'fn'
)
->willReturnOnConsecutiveCalls(
array(
'fn'
),
array(
'pr'
)
);
$dbi->expects($this->at(5))
$dbi->expects($this->exactly(2))
->method('getDefinition')
->with('d<"b', 'FUNCTION', 'fn')
->will(
$this->returnValue(
'fndef'
)
);
$dbi->expects($this->at(6))
->method('getProceduresOrFunctions')
->with('d<"b', 'PROCEDURE')
->will(
$this->returnValue(
array(
'pr'
)
)
);
$dbi->expects($this->at(7))
->method('getDefinition')
->with('d<"b', 'PROCEDURE', 'pr')
->will(
$this->returnValue(
'prdef'
)
->willReturnOnConsecutiveCalls(
'fndef',
'prdef'
);
$dbi->expects($this->once())
->method('getTable')
->will($this->returnValue(new Table('table', 'd<"b')));
->will($this->returnValue(new Table('table', 'd<"b', $dbi)));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -360,63 +326,39 @@ class ExportXmlTest extends PMATestCase
unset($GLOBALS['xml_export_procedures']);
$GLOBALS['output_charset_conversion'] = 0;
$result = array(
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$result_1 = array(
array(
'DEFAULT_COLLATION_NAME' => 'utf8_general_ci',
'DEFAULT_CHARACTER_SET_NAME' => 'utf-8',
)
);
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
->method('fetchResult')
->with(
'SELECT `DEFAULT_CHARACTER_SET_NAME`, `DEFAULT_COLLATION_NAME`'
. ' FROM `information_schema`.`SCHEMATA` WHERE `SCHEMA_NAME`'
. ' = \'d<"b\' LIMIT 1'
)
->will($this->returnValue($result));
$result = array(
$result_2 = array(
't1' => array(null, '"tbl"')
);
$dbi->expects($this->at(1))
->method('fetchResult')
->with(
'SHOW CREATE TABLE `d<"b`.`t1`',
0
)
->will($this->returnValue($result));
// isView
$dbi->expects($this->at(2))
->method('fetchResult')
->will($this->returnValue(true));
$result = array(
$result_3 = array(
't2' => array(null, '"tbl"')
);
$dbi->expects($this->at(3))
->method('fetchResult')
->with(
'SHOW CREATE TABLE `d<"b`.`t2`',
0
)
->will($this->returnValue($result));
// isView
$dbi->expects($this->at(4))
$dbi->expects($this->exactly(5))
->method('fetchResult')
->will($this->returnValue(false));
->willReturnOnConsecutiveCalls(
$result_1,
$result_2,
true,
$result_3,
false
);
$dbi->expects($this->any())
->method('getTable')
->will($this->returnValue(new Table('table', 'd<"b')));
->will($this->returnValue(new Table('table', 'd<"b', $dbi)));
$GLOBALS['dbi'] = $dbi;

3
test/classes/plugin/import/ImportLdiTest.php
View File

@ -82,6 +82,9 @@ class ImportLdiTest extends PMATestCase
$dbi->expects($this->any())->method('fetchRow')
->will($this->returnValue($fetchRowResult));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->object = new ImportLdi();

2
test/classes/plugin/import/ImportOdsTest.php
View File

@ -123,6 +123,8 @@ class ImportOdsTest extends PMATestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
//Test function called

77
test/libraries/PMA_PMD_common_test.php
View File

@ -54,8 +54,10 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('fetchResult')
->with(
"
@ -89,8 +91,10 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('fetchResult')
->with(
"SELECT `page_descr` FROM `pmadb`.`pdf_pages`"
@ -121,26 +125,15 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->exactly(2))
->method('query')
->with(
"DELETE FROM `pmadb`.`table_coords`"
. " WHERE `pdf_page_number` = " . $pg,
2,
PMA\libraries\DatabaseInterface::QUERY_STORE,
false
)
->will($this->returnValue(true));
->willReturnOnConsecutiveCalls(
true,
true
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->at(1))
->method('query')
->with(
"DELETE FROM `pmadb`.`pdf_pages` WHERE `page_nr` = " . $pg,
2,
PMA\libraries\DatabaseInterface::QUERY_STORE,
false
)
->will($this->returnValue(true));
$GLOBALS['dbi'] = $dbi;
$result = PMA_deletePage($pg);
@ -162,7 +155,7 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('fetchResult')
->with(
"SELECT `page_nr` FROM `pmadb`.`pdf_pages`"
@ -174,6 +167,9 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue(array($default_pg)));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$result = PMA_getDefaultPage($db);
@ -193,7 +189,7 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('fetchResult')
->with(
"SELECT `page_nr` FROM `pmadb`.`pdf_pages`"
@ -205,6 +201,9 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue(array()));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$result = PMA_getDefaultPage($db);
@ -225,7 +224,7 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('fetchResult')
->with(
"SELECT `page_nr` FROM `pmadb`.`pdf_pages`"
@ -237,6 +236,9 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue(array($default_pg)));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$result = PMA_getLoadingPage($db);
@ -257,30 +259,15 @@ class PMA_PMD_CommonTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->exactly(2))
->method('fetchResult')
->with(
"SELECT `page_nr` FROM `pmadb`.`pdf_pages`"
. " WHERE `db_name` = '" . $db . "'"
. " AND `page_descr` = '" . $db . "'",
null,
null,
2,
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue(array()));
->willReturnOnConsecutiveCalls(
array(),
array($first_pg)
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$dbi->expects($this->at(1))
->method('fetchResult')
->with(
"SELECT MIN(`page_nr`) FROM `pmadb`.`pdf_pages`"
. " WHERE `db_name` = '" . $db . "'",
null,
null,
2,
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue(array($first_pg)));
$GLOBALS['dbi'] = $dbi;
$result = PMA_getLoadingPage($db);

43
test/libraries/PMA_central_columns_test.php
View File

@ -126,6 +126,8 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
->will(
$this->returnValue(array("PMA_table", "PMA_table1", "PMA_table2"))
);
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
}
@ -153,28 +155,11 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
*/
public function testPMAGetColumnsList()
{
$GLOBALS['dbi']->expects($this->at(1))
$GLOBALS['dbi']->expects($this->exactly(2))
->method('fetchResult')
->with(
"SELECT * FROM `pma_central_columns` "
. "WHERE db_name = 'phpmyadmin' LIMIT 0, 25;",
null, null, $GLOBALS['controllink']
)
->will(
$this->returnValue($this->_columnData)
);
$GLOBALS['dbi']->expects($this->at(3))
->method('fetchResult')
->with(
"SELECT * FROM `pma_central_columns` "
. "WHERE db_name = 'phpmyadmin' LIMIT 1, 2;",
null, null, $GLOBALS['controllink']
)
->will(
$this->returnValue(
array_slice($this->_columnData, 1, 2)
)
->willReturnOnConsecutiveCalls(
$this->_columnData,
array_slice($this->_columnData, 1, 2)
);
$this->assertEquals(
@ -194,7 +179,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
*/
function testPMAGetCentralColumnsCount()
{
$GLOBALS['dbi']->expects($this->at(1))
$GLOBALS['dbi']->expects($this->once())
->method('fetchResult')
->with(
"SELECT count(db_name) FROM `pma_central_columns` "
@ -237,7 +222,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
$_REQUEST['table'] = 'PMA_table';
// when column exists in the central column list
$GLOBALS['dbi']->expects($this->at(2))
$GLOBALS['dbi']->expects($this->at(4))
->method('fetchResult')
->with(
"SELECT col_name FROM `pma_central_columns` "
@ -248,7 +233,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
$this->returnValue(array('col1'))
);
$GLOBALS['dbi']->expects($this->at(4))
$GLOBALS['dbi']->expects($this->at(7))
->method('tryQuery')
->with(
"DELETE FROM `pma_central_columns` "
@ -305,7 +290,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
$db = 'PMA_db';
$table = 'PMA_table';
$GLOBALS['dbi']->expects($this->at(3))
$GLOBALS['dbi']->expects($this->once())
->method('fetchResult')
->with(
"SELECT col_name FROM `pma_central_columns` "
@ -331,7 +316,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
$db = 'PMA_db';
$table = 'PMA_table';
$GLOBALS['dbi']->expects($this->at(3))
$GLOBALS['dbi']->expects($this->once())
->method('fetchResult')
->with(
"SELECT * FROM `pma_central_columns` "
@ -499,7 +484,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
*/
public function testPMAGetCentralColumnsListRaw()
{
$GLOBALS['dbi']->expects($this->at(1))
$GLOBALS['dbi']->expects($this->once())
->method('fetchResult')
->with(
"SELECT * FROM `pma_central_columns` "
@ -522,7 +507,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
*/
public function testPMAGetCentralColumnsListRawWithTable()
{
$GLOBALS['dbi']->expects($this->at(3))
$GLOBALS['dbi']->expects($this->once())
->method('fetchResult')
->with(
"SELECT * FROM `pma_central_columns` "
@ -586,7 +571,7 @@ class PMA_Central_Columns_Test extends PHPUnit_Framework_TestCase
*/
public function testPMAFindExistingColNames()
{
$GLOBALS['dbi']->expects($this->at(1))
$GLOBALS['dbi']->expects($this->once())
->method('fetchResult')
->with(
"SELECT * FROM `pma_central_columns` WHERE db_name = 'phpmyadmin'"

25
test/libraries/PMA_designer_test.php
View File

@ -60,7 +60,7 @@ class PMA_DesignerTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->once())
->method('tryQuery')
->with(
"SELECT `page_nr`, `page_descr` FROM `pmadb`.`pdf_pages`"
@ -71,24 +71,17 @@ class PMA_DesignerTest extends PHPUnit_Framework_TestCase
)
->will($this->returnValue('dummyRS'));
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(3))
->method('fetchAssoc')
->with('dummyRS')
->will(
$this->returnValue(array('page_nr' => '1', 'page_descr' => 'page1'))
->willReturnOnConsecutiveCalls(
array('page_nr' => '1', 'page_descr' => 'page1'),
array('page_nr' => '2', 'page_descr' => 'page2'),
false
);
$dbi->expects($this->at(2))
->method('fetchAssoc')
->with('dummyRS')
->will(
$this->returnValue(array('page_nr' => '2', 'page_descr' => 'page2'))
);
$dbi->expects($this->at(3))
->method('fetchAssoc')
->with('dummyRS')
->will($this->returnValue(false));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
}

40
test/libraries/PMA_insert_edit_test.php
View File

@ -132,33 +132,19 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
$dbi->expects($this->exactly(2))
->method('query')
->with(
'SELECT * FROM `db`.`table` WHERE a=1;',
null,
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue('result1'));
->willReturnOnConsecutiveCalls(
'result1',
'result2'
);
$dbi->expects($this->at(3))
->method('query')
->with(
'SELECT * FROM `db`.`table` WHERE b="fo\o";',
null,
PMA\libraries\DatabaseInterface::QUERY_STORE
)
->will($this->returnValue('result2'));
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('fetchAssoc')
->with('result1')
->will($this->returnValue(array('assoc1')));
$dbi->expects($this->at(4))
->method('fetchAssoc')
->with('result2')
->will($this->returnValue(array('assoc2')));
->willReturnOnConsecutiveCalls(
array('assoc1'),
array('assoc2')
);
$GLOBALS['dbi'] = $dbi;
$result = PMA_analyzeWhereClauses($clauses, 'table', 'db');
@ -2468,6 +2454,12 @@ class PMA_InsertEditTest extends PHPUnit_Framework_TestCase
->method('fetchSingleRow')
->with('SELECT * FROM `table` WHERE 1;')
->will($this->returnValue($prow));
$dbi->expects($this->exactly(2))
->method('escapeString')
->willReturnOnConsecutiveCalls(
$this->returnArgument(0),
"20\'12"
);
$GLOBALS['dbi'] = $dbi;

166
test/libraries/PMA_server_privileges_test.php
View File

@ -116,6 +116,7 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
'password' => 'pma_password',
'Table_priv' => 'pri1, pri2',
'Type' => 'Type',
'@@old_passwords' => 0,
);
$dbi->expects($this->any())->method('fetchSingleRow')
->will($this->returnValue($fetchSingleRow));
@ -127,10 +128,14 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$dbi->expects($this->any())->method('tryQuery')
->will($this->returnValue(true));
$dbi->expects($this->any())->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$GLOBALS['is_superuser'] = true;
$GLOBALS['is_grantuser'] = true;
$GLOBALS['is_createuser'] = true;
$GLOBALS['is_reload_priv'] = true;
}
/**
@ -500,8 +505,8 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$db, $table, $username, $hostname
);
$sql = "SELECT * FROM `mysql`.`user`"
. " WHERE `User` = '" . PMA\libraries\Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . PMA\libraries\Util::sqlAddSlashes($hostname) . "';";
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "';";
$this->assertEquals(
$sql,
$ret
@ -514,8 +519,8 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$db, $table, $username, $hostname
);
$sql = "SELECT * FROM `mysql`.`db`"
. " WHERE `User` = '" . PMA\libraries\Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . PMA\libraries\Util::sqlAddSlashes($hostname) . "'"
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " AND '" . PMA\libraries\Util::unescapeMysqlWildcards($db) . "'"
. " LIKE `Db`;";
$this->assertEquals(
@ -531,10 +536,10 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
);
$sql = "SELECT `Table_priv`"
. " FROM `mysql`.`tables_priv`"
. " WHERE `User` = '" . PMA\libraries\Util::sqlAddSlashes($username) . "'"
. " AND `Host` = '" . PMA\libraries\Util::sqlAddSlashes($hostname) . "'"
. " WHERE `User` = '" . $GLOBALS['dbi']->escapeString($username) . "'"
. " AND `Host` = '" . $GLOBALS['dbi']->escapeString($hostname) . "'"
. " AND `Db` = '" . PMA\libraries\Util::unescapeMysqlWildcards($db) . "'"
. " AND `Table_name` = '" . PMA\libraries\Util::sqlAddSlashes($table) . "';";
. " AND `Table_name` = '" . $GLOBALS['dbi']->escapeString($table) . "';";
$this->assertEquals(
$sql,
$ret
@ -549,7 +554,7 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$this->assertEquals(
"SELECT `Table_priv` FROM `mysql`.`tables_priv` "
. "WHERE `User` = 'pma_username' AND "
. "`Host` = 'pma_hostname' AND `Db` = 'db\' AND' AND "
. "`Host` = 'pma_hostname' AND `Db` = 'db' AND' AND "
. "`Table_name` = 'pma_table';",
$ret
);
@ -626,48 +631,6 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
);
}
/**
* Test for PMA_getSqlQueriesForDisplayAndAddUser
*
* @return void
*/
public function testPMAGetSqlQueriesForDisplayAndAddNewUser()
{
$username = 'pma_username';
$hostname = 'pma_hostname';
$password = 'pma_password';
$_REQUEST['adduser_submit'] = true;
$_POST['pred_username'] = 'any';
$_POST['pred_hostname'] = 'localhost';
$_POST['pred_password'] = 'keep';
$_REQUEST['createdb-3'] = true;
$_REQUEST['authentication_plugin'] = 'mysql_native_password';
list($create_user_real, $create_user_show, $real_sql_query, $sql_query)
= PMA_getSqlQueriesForDisplayAndAddUser(
$username, $hostname,
(isset($password) ? $password : '')
);
$this->assertEquals(
"CREATE USER 'pma_username'@'pma_hostname' "
. "IDENTIFIED WITH mysql_native_password AS 'pma_password';",
$create_user_real
);
$this->assertEquals(
"CREATE USER 'pma_username'@'pma_hostname' "
. "IDENTIFIED WITH mysql_native_password AS '***';",
$create_user_show
);
$this->assertEquals(
"GRANT USAGE ON *.* TO 'pma_username'@'pma_hostname' REQUIRE NONE;",
$real_sql_query
);
$this->assertEquals(
"GRANT USAGE ON *.* TO 'pma_username'@'pma_hostname' REQUIRE NONE;",
$sql_query
);
}
/**
* Test for PMA_addUser
*
@ -675,6 +638,17 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
*/
public function testPMAAddUser()
{
// Case 1 : Test with Newer version
$restoreMySQLVersion = "PMANORESTORE";
if (! PMA_HAS_RUNKIT) {
$this->markTestSkipped(
'Cannot redefine constant. Missing runkit extension'
);
} else {
$restoreMySQLVersion = PMA_MYSQL_INT_VERSION;
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', 50706);
}
$dbname = 'pma_dbname';
$username = 'pma_username';
$hostname = 'pma_hostname';
@ -710,6 +684,53 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
false,
$_add_user_error
);
if ($restoreMySQLVersion !== "PMANORESTORE") {
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', $restoreMySQLVersion);
}
// Case 2 : Test with older versions
$restoreMySQLVersion = "PMANORESTORE";
if (! PMA_HAS_RUNKIT) {
$this->markTestSkipped(
'Cannot redefine constant. Missing runkit extension'
);
} else {
$restoreMySQLVersion = PMA_MYSQL_INT_VERSION;
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', 50506);
}
list(
$ret_message,,, $sql_query,
$_add_user_error
) = PMA_addUser(
$dbname,
$username,
$hostname,
$dbname,
true
);
$this->assertEquals(
'You have added a new user.',
$ret_message->getMessage()
);
$this->assertEquals(
"CREATE USER ''@'localhost';"
. "GRANT USAGE ON *.* TO ''@'localhost' REQUIRE NONE;"
. "SET PASSWORD FOR ''@'localhost' = '***';"
. "GRANT ALL PRIVILEGES ON `pma_dbname`.* TO ''@'localhost';",
$sql_query
);
$this->assertEquals(
false,
$_add_user_error
);
if ($restoreMySQLVersion !== "PMANORESTORE") {
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', $restoreMySQLVersion);
}
}
/**
@ -851,6 +872,9 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$dbi->expects($this->at(1))
->method('fetchRow')
->will($this->returnValue(false));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -945,6 +969,17 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
*/
public function testPMAGetSqlQueriesForDisplayAndAddUser()
{
$restoreMySQLVersion = "PMANORESTORE";
if (! PMA_HAS_RUNKIT) {
$this->markTestSkipped(
'Cannot redefine constant. Missing runkit extension'
);
} else {
$restoreMySQLVersion = PMA_MYSQL_INT_VERSION;
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', 50706);
}
$username = "PMA_username";
$hostname = "PMA_hostname";
$password = "pma_password";
@ -997,6 +1032,10 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
"You have added a new user.",
$message->getMessage()
);
if ($restoreMySQLVersion !== "PMANORESTORE") {
runkit_constant_redefine('PMA_MYSQL_INT_VERSION', $restoreMySQLVersion);
}
}
/**
@ -1090,6 +1129,10 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
);
$dbi->expects($this->any())->method('fetchResult')
->will($this->returnValue($fields_info));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -1195,6 +1238,9 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
);
$dbi->expects($this->any())->method('fetchResult')
->will($this->returnValue($fields_info));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -1267,6 +1313,9 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
);
$dbi->expects($this->any())->method('fetchResult')
->will($this->returnValue($fields_info));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -1342,6 +1391,9 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
);
$dbi->expects($this->any())->method('fetchResult')
->will($this->returnValue($fields_info));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -1653,6 +1705,9 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$dbi->expects($this->any())->method('fetchValue')
->will($this->returnValue($expected_userGroup));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -1715,6 +1770,9 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$dbi->expects($this->any())->method('fetchValue')
->will($this->returnValue($expected_userGroup));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
@ -2218,6 +2276,10 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
)
)
);
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$_GET['initial'] = 'A';
$GLOBALS['dbi'] = $dbi;
@ -2253,6 +2315,10 @@ class PMA_ServerPrivileges_Test extends PHPUnit_Framework_TestCase
$dbi->expects($this->any())
->method('getError')
->will($this->returnValue('Some error occurred!'));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
// Test case 1 : empty queries

36
test/libraries/PMA_server_user_groups_test.php
View File

@ -179,12 +179,16 @@ class PMA_ServerUserGroupsTest extends PHPUnit_Framework_TestCase
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->at(0))
->method('query')
->with($userDelQuery);
$dbi->expects($this->at(1))
->method('query')
->with($userDelQuery);
$dbi->expects($this->at(3))
->method('query')
->with($userGrpDelQuery);
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
PMA_deleteUserGroup('ug');
@ -217,24 +221,22 @@ class PMA_ServerUserGroupsTest extends PHPUnit_Framework_TestCase
->method('tryQuery')
->with($expectedQuery)
->will($this->returnValue(true));
$dbi->expects($this->at(1))
$dbi->expects($this->exactly(2))
->method('fetchAssoc')
->withAnyParameters()
->will(
$this->returnValue(
array(
'usergroup' => 'ug',
'tab' => 'server_sql',
'allowed' => 'Y'
)
)
->willReturnOnConsecutiveCalls(
array(
'usergroup' => 'ug',
'tab' => 'server_sql',
'allowed' => 'Y'
),
false
);
$dbi->expects($this->at(2))
->method('fetchAssoc')
->withAnyParameters()
->will($this->returnValue(false));
$dbi->expects($this->once())
->method('freeResult');
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
// editing a user group

11
test/libraries/PMA_user_preferences_test.php
View File

@ -128,6 +128,10 @@ class PMA_User_Preferences_Test extends PHPUnit_Framework_TestCase
)
)
);
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$result = PMA_loadUserprefs();
@ -215,6 +219,10 @@ class PMA_User_Preferences_Test extends PHPUnit_Framework_TestCase
->with($query2, null)
->will($this->returnValue(true));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->assertTrue(
PMA_saveUserprefs(array(1))
@ -246,6 +254,9 @@ class PMA_User_Preferences_Test extends PHPUnit_Framework_TestCase
->method('getError')
->with(null)
->will($this->returnValue("err1"));
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;

48
test/libraries/common/PMA_quoting_slashing_test.php
View File

@ -20,54 +20,6 @@
*/
class PMA_QuotingSlashing_Test extends PHPUnit_Framework_TestCase
{
/**
* sqlAddslashes test
*
* @return void
*/
public function testAddSlashes()
{
$string = "\'test''\''\'\r\t\n";
$this->assertEquals(
"\\\\\\\\\'test\'\'\\\\\\\\\'\'\\\\\\\\\'\\r\\t\\n",
PMA\libraries\Util::sqlAddSlashes($string, true, true, true)
);
$this->assertEquals(
"\\\\\\\\\\'test\\'\\'\\\\\\\\\\'\\'\\\\\\\\\\'\\r\\t\\n",
PMA\libraries\Util::sqlAddSlashes($string, true, true, false)
);
$this->assertEquals(
"\\\\\\\\\'test\'\'\\\\\\\\\'\'\\\\\\\\\'\r\t\n",
PMA\libraries\Util::sqlAddSlashes($string, true, false, true)
);
$this->assertEquals(
"\\\\\\\\\\'test\\'\\'\\\\\\\\\\'\\'\\\\\\\\\\'\r\t\n",
PMA\libraries\Util::sqlAddSlashes($string, true, false, false)
);
$this->assertEquals(
"\\\\\'test\'\'\\\\\'\'\\\\\'\\r\\t\\n",
PMA\libraries\Util::sqlAddSlashes($string, false, true, true)
);
$this->assertEquals(
"\\\\\\'test\\'\\'\\\\\\'\\'\\\\\\'\\r\\t\\n",
PMA\libraries\Util::sqlAddSlashes($string, false, true, false)
);
$this->assertEquals(
"\\\\\'test\'\'\\\\\'\'\\\\\'\r\t\n",
PMA\libraries\Util::sqlAddSlashes($string, false, false, true)
);
$this->assertEquals(
"\\\\\\'test\\'\\'\\\\\\'\\'\\\\\\'\r\t\n",
PMA\libraries\Util::sqlAddSlashes($string, false, false, false)
);
$this->assertEquals(
"\\\\\\'",
PMA\libraries\Util::sqlAddSlashes('\\\'')
);
}
/**
* data provider for PMA\libraries\Util::unQuote test
*

8
test/libraries/rte/PMA_EVN_getQueryFromRequest_test.php
View File

@ -48,6 +48,14 @@ class PMA_EVN_GetQueryFromRequest_Test extends PHPUnit_Framework_TestCase
unset($_REQUEST);
$_REQUEST = $request;
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())
->method('escapeString')
->will($this->returnArgument(0));
$GLOBALS['dbi'] = $dbi;
$this->assertEquals($query, PMA_EVN_getQueryFromRequest());
$this->assertEquals($num_err, count($errors));
}

20
test/libraries/rte/PMA_RTN_getQueryFromRequest_test.php
View File

@ -48,10 +48,30 @@ class PMA_RTN_GetQueryFromRequest_Test extends PHPUnit_Framework_TestCase
$errors = array();
PMA_RTN_setGlobals();
$old_dbi = isset($GLOBALS['dbi']) ? $GLOBALS['dbi'] : null;
$dbi = $this->getMockBuilder('PMA\libraries\DatabaseInterface')
->disableOriginalConstructor()
->getMock();
$dbi->expects($this->any())
->method('escapeString')
->will(
$this->returnValueMap(
array(
array('foo', null, 'foo'),
array("foo's bar", null, "foo\'s bar"),
array('', null, '')
)
)
);
$GLOBALS['dbi'] = $dbi;
unset($_REQUEST);
$_REQUEST = $request;
$this->assertEquals($query, PMA_RTN_getQueryFromRequest());
$this->assertEquals($num_err, count($errors));
// reset
$GLOBALS['dbi'] = $old_dbi;
}
/**

4
user_password.php
View File

@ -236,7 +236,7 @@ function PMA_changePassUrlParamsAndSubmitQuery(
. ' IDENTIFIED with ' . $orig_auth_plugin . ' BY '
. (($password == '')
? '\'\''
: '\'' . PMA\libraries\Util::sqlAddSlashes($password) . '\'');
: '\'' . $GLOBALS['dbi']->escapeString($password) . '\'');
} else if ($serverType == 'MariaDB'
&& PMA_MYSQL_INT_VERSION >= 50200
&& PMA_MYSQL_INT_VERSION < 100100
@ -264,7 +264,7 @@ function PMA_changePassUrlParamsAndSubmitQuery(
$local_query = 'SET password = ' . (($password == '')
? '\'\''
: $hashing_function . '(\''
. PMA\libraries\Util::sqlAddSlashes($password) . '\')');
. $GLOBALS['dbi']->escapeString($password) . '\')');
}
if (! @$GLOBALS['dbi']->tryQuery($local_query)) {
PMA\libraries\Util::mysqlDie(