From f964639676eb9d99fba4b339fa3d823be709047b Mon Sep 17 00:00:00 2001
From: Rouslan Placella <rouslan@placella.com>
Date: Tue, 31 May 2011 11:14:15 +0100
Subject: [PATCH] Backquote Routine parameters in the generated query.

---
 libraries/common.lib.php      | 40 +++++++++++++++++++++++++++++++++++
 libraries/db_routines.inc.php |  6 +++---
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index 41bc253dbc..94469d23c9 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -841,6 +841,46 @@ function PMA_backquote($a_name, $do_it = true)
     }
 } // end of the 'PMA_backquote()' function
 
+/**
+ * Removes backquotes on both sides of a database, table or field name.
+ * and the backquotes inside the names that were escaped with another backquote.
+ *
+ * example:
+ * <code>
+ * echo PMA_unbackquote('`owner``s db`'); // 'owner`s db'
+ *
+ * </code>
+ *
+ * @uses    PMA_unbackquote()
+ * @uses    is_array()
+ * @uses    strlen()
+ * @uses    substr()
+ * @uses    trim()
+ * @uses    str_replace()
+ * @param   mixed    $a_name    the database, table or field name to "backquote"
+ *                              or array of it
+ * @return  mixed    the database, table or field name(s)
+                     after being stripped of backquotes
+ * @access  public
+ */
+function PMA_unbackquote($a_name)
+{
+    if (is_array($a_name)) {
+        foreach ($a_name as &$data) {
+            $data = PMA_unbackquote($data);
+        }
+        return $a_name;
+    }
+
+    // '0' is also empty for php :-(
+    if (strlen($a_name) && $a_name !== '*') {
+        if (substr(trim($a_name), 0, 1) == '`' && substr(trim($a_name), -1) == '`') {
+            $a_name = substr(trim($a_name), 1, -1);
+            return str_replace('``', '`', $a_name);
+        }
+    }
+    return $a_name;
+} // end of the 'PMA_unbackquote()' function
 
 /**
  * Defines the <CR><LF> value depending on the user OS.
diff --git a/libraries/db_routines.inc.php b/libraries/db_routines.inc.php
index cbda02d710..3f9e06e2d0 100644
--- a/libraries/db_routines.inc.php
+++ b/libraries/db_routines.inc.php
@@ -169,7 +169,7 @@ function parseListOfParameters($str, &$num, &$dir, &$name, &$type, &$length)
 	    }
 	    // Get name
 	    $space_pos = strpos($value, ' ');
-	    $name[] = htmlspecialchars(substr($value, 0, $space_pos));
+	    $name[] = htmlspecialchars(PMA_unbackquote(substr($value, 0, $space_pos)));
 	    $value = ltrim(substr($value, $space_pos));
 	    // Get type
 	    $brac_pos = strpos($value, '(');
@@ -615,10 +615,10 @@ if (! empty($_GET['exportroutine']) && ! empty($_GET['routinename']) && ! empty(
         for ($i=0; $i<count($_REQUEST['routine_param_name']); $i++) {
             if (! empty($_REQUEST['routine_param_name'][$i]) && ! empty($_REQUEST['routine_param_type'][$i])) {
                 if ($_REQUEST['routine_type'] == 'PROCEDURE' && ! empty($_REQUEST['routine_param_dir'][$i])) {
-                    $params .= $_REQUEST['routine_param_dir'][$i] . " " . $_REQUEST['routine_param_name'][$i] . " "
+                    $params .= $_REQUEST['routine_param_dir'][$i] . " " . PMA_backquote($_REQUEST['routine_param_name'][$i]) . " "
                             . $_REQUEST['routine_param_type'][$i];
                 } else if ($_REQUEST['routine_type'] == 'FUNCTION') {
-                    $params .= $_REQUEST['routine_param_name'][$i] . " " . $_REQUEST['routine_param_type'][$i];
+                    $params .= PMA_backquote($_REQUEST['routine_param_name'][$i]) . " " . $_REQUEST['routine_param_type'][$i];
                 } else if (! $warned_about_dir) {
                     $warned_about_dir = true;
                     $routine_errors[] = sprintf(__('Invalid Direction "%s" given for a Parameter.'),