diff options
| author | webchick <webchick@24967.no-reply.drupal.org> | 2011-05-17 23:57:40 -0500 |
|---|---|---|
| committer | webchick <webchick@24967.no-reply.drupal.org> | 2011-05-17 23:57:40 -0500 |
| commit | e77f87506c0355bb357bf32651148768e4a302b8 (patch) | |
| tree | 57ee327a006e415b41612807ebe8468f4b03c68f /includes/database/pgsql | |
| parent | e27392c158c328ab3440c634c99212e302ef2f74 (diff) | |
| download | brdo-e77f87506c0355bb357bf32651148768e4a302b8.tar.gz brdo-e77f87506c0355bb357bf32651148768e4a302b8.tar.bz2 | |
Issue #1105848 by cafuego: Fixed Unsafe query comments possible via UI.
Diffstat (limited to 'includes/database/pgsql')
| -rw-r--r-- | includes/database/pgsql/query.inc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/includes/database/pgsql/query.inc b/includes/database/pgsql/query.inc index fe7909e17..f3783a9ca 100644 --- a/includes/database/pgsql/query.inc +++ b/includes/database/pgsql/query.inc @@ -103,8 +103,8 @@ class InsertQuery_pgsql extends InsertQuery { } public function __toString() { - // Create a comments string to prepend to the query. - $comments = (!empty($this->comments)) ? '/* ' . implode('; ', $this->comments) . ' */ ' : ''; + // Create a sanitized comment string to prepend to the query. + $comments = $this->connection->makeComment($this->comments); // Default fields are always placed first for consistency. $insert_fields = array_merge($this->defaultFields, $this->insertFields); |