Merge remote-tracking branch 'security/fix/293-sql-injection' into QA…

…_4_9
phpmyadmin · Jan 7, 2020 · ce10567 · ce10567
2 parents 156231d + c86acbf
commit ce10567
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/libraries/classes/Server/Privileges.php b/libraries/classes/Server/Privileges.php
@@ -3067,7 +3067,7 @@ public static function getExtraDataForAjaxBehavior(
 
         if (isset($_GET['validate_username'])) {
             $sql_query = "SELECT * FROM `mysql`.`user` WHERE `User` = '"
-                . $_GET['username'] . "';";
+                . $GLOBALS['dbi']->escapeString($_GET['username']) . "';";
             $res = $GLOBALS['dbi']->query($sql_query);
             $row = $GLOBALS['dbi']->fetchRow($res);
             if (empty($row)) {