[fix] Check table name for tableQuote()

catfan · Dec 9, 2019 · a6d88e7 · a6d88e7
1 parent e78be9e
commit a6d88e7
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Medoo.php b/src/Medoo.php
@@ -339,7 +339,6 @@ public function exec($query, $map = [])
 		{
 			echo $this->generate($query, $map);
 
-			$this->statement = null;
 			$this->debug_mode = false;
 
 			return false;
@@ -476,6 +475,11 @@ public function quote($string)
 
 	protected function tableQuote($table)
 	{
+		if (!preg_match('/^[a-zA-Z0-9_]+$/i', $table))
+		{
+			throw new InvalidArgumentException("Incorrect table name \"$table\"");
+		}
+
 		return '"' . $this->prefix . $table . '"';
 	}