Fixed SQL injection.

shannah · Apr 7, 2019 · eb4265e · eb4265e · shannah · Apr 7, 2019
1 parent e64f855
commit eb4265e
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/lib/SQL/Compiler.php b/lib/SQL/Compiler.php
@@ -84,7 +84,7 @@ function compileFunctionOpts($args){
 			} else if ( $func_arg['type'] == 'function'){
 				$out .= $this->compileFunction($func_arg['value'], false).', ';
 			} else if ( $func_arg['type'] == 'text_val' ){
-				$out .= "'".$func_arg['value']."', ";
+				$out .= "'".addslashes($func_arg['value'])."', ";
 			} else if ( $func_arg['type'] == 'expression' ){
 
 				$out .= $this->compileExpression($func_arg['type'], $func_arg['value']).", ";
@@ -138,7 +138,7 @@ function getWhereValue ($arg)
                 $value = $arg['value'];
                 break;
             case 'text_val':
-                $value = '\''.$arg['value'].'\'';
+                $value = '\''.addslashes($arg['value']).'\'';
                 break;
             case 'subclause':
                 $value = '('.$this->compileSearchClause($arg['value']).')';
@@ -209,7 +209,7 @@ function getParams($arg)
 						$value[] = $arg['value'][$i];
 						break;
 					case 'text_val':
-						$value[] = '\''.$arg['value'][$i].'\'';
+						$value[] = '\''.addslashes($arg['value'][$i]).'\'';
 						break;
 					case 'function':
 						$val = $this->compileFunction($arg['value'][$i]);
@@ -415,7 +415,7 @@ function compileSelect()
 						break;
 
 					case 'text_val':
-						$column = '\''.$this->tree['columns'][$i]['value'].'\'';
+						$column = '\''.addslashes($this->tree['columns'][$i]['value']).'\'';
 
 
 						if ( $this->tree['columns'][$i]['alias'] ){
@@ -638,7 +638,7 @@ function compileExpression($type, $val){
     		case 'null':
     			return $val;
     		case 'text_val';
-    			return "'".$val."'";
+    			return "'".addslashes($val)."'";
     		case 'ident':
     			return $this->compileIdent($val);
     		case 'function':
@@ -673,7 +673,7 @@ function compileInterval($val){
                 $out .= $val;
                 break;
             case 'text_val':
-                $out .= "'".$val."'";
+                $out .= "'".addslashes($val)."'";
                 break;
             default:
                 throw new Exception("Failed to compile interval.  Wrong expression type ".$val['expression_type']);