From aa962973b95736e573fb9a1f9864c1e95a3fd836 Mon Sep 17 00:00:00 2001
From: Damien Regad <dregad@mantisbt.org>
Date: Wed, 26 Feb 2014 13:28:34 +0100
Subject: [PATCH] Install: escape strings in generated config_inc.php

Fixes #17012
---
 admin/install.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/admin/install.php b/admin/install.php
index f164ba0d35..1a6240c2e9 100644
--- a/admin/install.php
+++ b/admin/install.php
@@ -998,9 +998,9 @@ function print_test( $p_test_description, $p_result, $p_hard_fail = true, $p_mes
 	$t_config = '<?php' . PHP_EOL
 		. "\$g_hostname               = '$f_hostname';" . PHP_EOL
 		. "\$g_db_type                = '$f_db_type';" . PHP_EOL
-		. "\$g_database_name          = '$f_database_name';" . PHP_EOL
-		. "\$g_db_username            = '$f_db_username';" . PHP_EOL
-		. "\$g_db_password            = '$f_db_password';" . PHP_EOL;
+		. "\$g_database_name          = '" . addslashes( $f_database_name ) . "';" . PHP_EOL
+		. "\$g_db_username            = '" . addslashes( $f_db_username ) . "';" . PHP_EOL
+		. "\$g_db_password            = '" . addslashes( $f_db_password ) . "';" . PHP_EOL;
 
 	switch( $f_db_type ) {
 		case 'db2':
@@ -1027,7 +1027,7 @@ function print_test( $p_test_description, $p_result, $p_hard_fail = true, $p_mes
 	$t_config .=
 		  "\$g_default_timezone       = '$f_timezone';" . PHP_EOL
 		. PHP_EOL
-		. "\$g_crypto_master_salt     = '$f_crypto_master_salt';" . PHP_EOL;
+		. "\$g_crypto_master_salt     = '" . addslashes( $f_crypto_master_salt ) . "';" . PHP_EOL;
 
 	$t_write_failed = true;