diff options
| author | webchick <webchick@24967.no-reply.drupal.org> | 2011-05-17 23:57:40 -0500 |
|---|---|---|
| committer | webchick <webchick@24967.no-reply.drupal.org> | 2011-05-17 23:57:40 -0500 |
| commit | e77f87506c0355bb357bf32651148768e4a302b8 (patch) | |
| tree | 57ee327a006e415b41612807ebe8468f4b03c68f /includes/database/sqlite | |
| parent | e27392c158c328ab3440c634c99212e302ef2f74 (diff) | |
| download | brdo-e77f87506c0355bb357bf32651148768e4a302b8.tar.gz brdo-e77f87506c0355bb357bf32651148768e4a302b8.tar.bz2 | |
Issue #1105848 by cafuego: Fixed Unsafe query comments possible via UI.
Diffstat (limited to 'includes/database/sqlite')
| -rw-r--r-- | includes/database/sqlite/query.inc | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/includes/database/sqlite/query.inc b/includes/database/sqlite/query.inc index a176ed649..6b8a72f2a 100644 --- a/includes/database/sqlite/query.inc +++ b/includes/database/sqlite/query.inc @@ -32,8 +32,8 @@ class InsertQuery_sqlite extends InsertQuery { } public function __toString() { - // Create a comments string to prepend to the query. - $comments = (!empty($this->comments)) ? '/* ' . implode('; ', $this->comments) . ' */ ' : ''; + // Create a sanitized comment string to prepend to the query. + $comments = $this->connection->makeComment($this->comments); // Produce as many generic placeholders as necessary. $placeholders = array_fill(0, count($this->insertFields), '?'); @@ -148,8 +148,8 @@ class DeleteQuery_sqlite extends DeleteQuery { */ class TruncateQuery_sqlite extends TruncateQuery { public function __toString() { - // Create a comments string to prepend to the query. - $comments = (!empty($this->comments)) ? '/* ' . implode('; ', $this->comments) . ' */ ' : ''; + // Create a sanitized comment string to prepend to the query. + $comments = $this->connection->makeComment($this->comments); return $comments . 'DELETE FROM {' . $this->connection->escapeTable($this->table) . '} '; } |