- Patch 13180 by chx: renamed check_query() to db_escape_string() and implemtented it properly per database backend.

  Read the manual for pg_escape_string:  "Use of this function is recommended instead of addslashes()." Or read sqlite_escape_string: "addslashes() should NOT be used to quote your strings for SQLite queries; it will lead to strange results when retrieving your data."

1 files changed, 2 insertions, 2 deletions

diff --git a/modules/user/user.module b/modules/user/user.module
index 390eb075e..f9337d1d3 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -152,13 +152,13 @@ function user_save($account, $array = array(), $category = 'account') {
     // because we don't have a fully initialized user object yet.
     foreach ($array as $key => $value) {
       if ($key == 'pass') {
-        $fields[] = check_query($key);
+        $fields[] = db_escape_string($key);
         $values[] = md5($value);
         $s[] = "'%s'";
       }
       else if (substr($key, 0, 4) !== 'auth') {
         if (in_array($key, $user_fields)) {
-          $fields[] = check_query($key);
+          $fields[] = db_escape_string($key);
           $values[] = $value;
           $s[] = "'%s'";
         }