tonyair/silverstripe-framework
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-framework synced 2024-10-22 12:05:37 +00:00
Code Issues Projects Releases Wiki Activity

SECURITY Backporting MySQLDatabase->addslashes() to use mysql_real_escape_string() instead of the non-multibyte-safe addslashes() PHP function, and using it in Convert::raw2sql()

Browse Source
This commit is contained in:
Ingo Schommer 2011-09-15 14:39:52 +02:00
parent b37836ffa1
commit ca7878453f
3 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
core/Convert.php
View File

@ -104,9 +104,8 @@ class Convert extends Object {
if(is_array($val)) { if(is_array($val)) {
foreach($val as $k => $v) $val[$k] = self::raw2sql($v); foreach($val as $k => $v) $val[$k] = self::raw2sql($v);
return $val; return $val;
} else { } else {
return addslashes($val); return DB::getConn()->addslashes($val);
} }
} }

8
core/model/Database.php
View File

@ -111,6 +111,14 @@ abstract class Database extends Object {
*/ */
protected abstract function tableList(); protected abstract function tableList();
/**
* Returns an escaped string.
*
* @param string
* @return string - escaped string
*/
abstract function addslashes($val);
/** /**
* The table list, generated by the tableList() function. * The table list, generated by the tableList() function.
* Used by the requireTable() function. * Used by the requireTable() function.

7
core/model/MySQLDatabase.php
View File

@ -400,6 +400,13 @@ class MySQLDatabase extends Database {
user_error($msg, $errorLevel); user_error($msg, $errorLevel);
} }
/*
* This will return text which has been escaped in a database-friendly manner.
*/
function addslashes($value){
return mysql_real_escape_string($value, $this->dbConn);
}
} }
/** /**