AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid potential SQL injections without breaking compatibility with plugins

Browse Source
This commit is contained in:
Frédéric Guillot
2023-06-30 21:08:11 -07:00
committed by Frédéric Guillot
parent 03eca81c0e
commit 25b93343ba
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libs/picodb/lib/PicoDb/Database.php
View File

@@ -5,6 +5,7 @@ namespace PicoDb;
use Closure; use Closure;
use PDOException; use PDOException;
use LogicException; use LogicException;
use PicoDb\SQLException;
use PicoDb\Driver\Mssql; use PicoDb\Driver\Mssql;
use PicoDb\Driver\Sqlite; use PicoDb\Driver\Sqlite;
use PicoDb\Driver\Mysql; use PicoDb\Driver\Mysql;
@@ -215,6 +216,11 @@ class Database
return $value; return $value;
} }
// Avoid potential SQL injection
if (preg_match('/^[a-z0-9_]+$/', $value) === 0) {
throw new SQLException('Invalid identifier: '.$value);
}
if (! empty($table)) { if (! empty($table)) {
return $this->driver->escape($table).'.'.$this->driver->escape($value); return $this->driver->escape($table).'.'.$this->driver->escape($value);
} }