diff --git a/libraries/classes/CreateAddField.php b/libraries/classes/CreateAddField.php
index 63e320c211af..3c29fa4ded1f 100644
--- a/libraries/classes/CreateAddField.php
+++ b/libraries/classes/CreateAddField.php
@@ -397,8 +397,12 @@ public function getTableCreationQuery(string $db, string $table): string
. Util::backquote(trim($table)) . ' (' . $sqlStatement . ')';
// Adds table type, character set, comments and partition definition
- if (! empty($_POST['tbl_storage_engine']) && ($_POST['tbl_storage_engine'] !== 'Default')) {
- $sqlQuery .= ' ENGINE = ' . $this->dbi->escapeString($_POST['tbl_storage_engine']);
+ if (
+ ! empty($_POST['tbl_storage_engine'])
+ && ($_POST['tbl_storage_engine'] !== 'Default')
+ && StorageEngine::isValid($_POST['tbl_storage_engine'])
+ ) {
+ $sqlQuery .= ' ENGINE = ' . $_POST['tbl_storage_engine'];
}
if (! empty($_POST['tbl_collation'])) {
diff --git a/psalm-baseline.xml b/psalm-baseline.xml
index 67cb0580ac7a..f0a558c0ae69 100644
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -4652,13 +4652,14 @@
$_POST['partitions']
-
+
$_POST['partition_by']
$_POST['partition_count']
$_POST['partition_expr']
$_POST['subpartition_by']
$_POST['subpartition_count']
$_POST['subpartition_expr']
+ $_POST['tbl_storage_engine']
diff --git a/test/classes/CreateAddFieldTest.php b/test/classes/CreateAddFieldTest.php
index 59f62d63483c..470e8c31254d 100644
--- a/test/classes/CreateAddFieldTest.php
+++ b/test/classes/CreateAddFieldTest.php
@@ -263,7 +263,24 @@ public function providerGetTableCreationQuery(): array
],
],
[
- 'CREATE TABLE `db`.`table` () ENGINE = Inno\\\'DB CHARSET=armscii8 COMMENT = \'my \\\'table\';',
+ 'CREATE TABLE `db`.`table` () ENGINE = dummy CHARSET=armscii8 COMMENT = \'my \\\'table\';',
+ 'db',
+ 'table',
+ [
+ 'field_name' => [],
+ 'primary_indexes' => '{}',
+ 'indexes' => '{}',
+ 'unique_indexes' => '{}',
+ 'fulltext_indexes' => '{}',
+ 'spatial_indexes' => '{}',
+ 'tbl_storage_engine' => 'dummy',
+ 'tbl_collation' => 'armscii8',
+ 'connection' => 'aaaa',
+ 'comment' => 'my \'table',
+ ],
+ ],
+ [
+ 'CREATE TABLE `db`.`table` () CHARSET=armscii8 COMMENT = \'my \\\'table\';',
'db',
'table',
[