From bcde526db18717d460642f49216d2e7f9e7d2722 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 22 Jul 2012 16:53:32 +0200 Subject: [PATCH] Fix: sql injection for create database --- htdocs/core/db/mysql.class.php | 4 ++-- htdocs/core/db/mysqli.class.php | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/htdocs/core/db/mysql.class.php b/htdocs/core/db/mysql.class.php index 4dee1c977bf..a521df50403 100644 --- a/htdocs/core/db/mysql.class.php +++ b/htdocs/core/db/mysql.class.php @@ -800,8 +800,8 @@ class DoliDBMysql if (empty($collation)) $collation=$this->forcecollate; // ALTER DATABASE dolibarr_db DEFAULT CHARACTER SET latin DEFAULT COLLATE latin1_swedish_ci - $sql = 'CREATE DATABASE '.$database; - $sql.= ' DEFAULT CHARACTER SET '.$charset.' DEFAULT COLLATE '.$collation; + $sql = "CREATE DATABASE '".$this->escape($database)."'"; + $sql.= " DEFAULT CHARACTER SET '".$this->escape($charset)."' DEFAULT COLLATE '".$this->escape($collation)."'"; dol_syslog($sql,LOG_DEBUG); $ret=$this->query($sql); diff --git a/htdocs/core/db/mysqli.class.php b/htdocs/core/db/mysqli.class.php index 7afea5a8da3..474efbabad3 100644 --- a/htdocs/core/db/mysqli.class.php +++ b/htdocs/core/db/mysqli.class.php @@ -794,8 +794,8 @@ class DoliDBMysqli if (empty($collation)) $collation=$this->forcecollate; // ALTER DATABASE dolibarr_db DEFAULT CHARACTER SET latin DEFAULT COLLATE latin1_swedish_ci - $sql = 'CREATE DATABASE '.$database; - $sql.= ' DEFAULT CHARACTER SET '.$charset.' DEFAULT COLLATE '.$collation; + $sql = "CREATE DATABASE '".$this->escape($database)."'"; + $sql.= " DEFAULT CHARACTER SET '".$this->escape($charset)."' DEFAULT COLLATE '".$this->escape($collation)."'"; dol_syslog($sql,LOG_DEBUG); $ret=$this->query($sql);