WordPress.org
Get WordPress

Plugin Directory

Changeset 1779006


Ignore:
Timestamp:
11/30/2017 08:37:06 PM (8 years ago)
Author:
viewup
Message:

fix against SQL injection

File:
1 edited

Legend:

Unmodified
Added
Removed

  • up-user-datakeeper/trunk/class/db.php

    r1778970 r1779006  
    2222
    2323        $fieldsImploded = implode(",\n", $fields);
    24 
    25         $sql = "CREATE TABLE $tableName ( \n$fieldsImploded\n ) $charsetCollate;";     
     24       
     25        $sql = $wpdb->prepare('CREATE TABLE %s ( \n%s\n ) $charsetCollate;"', [
     26            $tableName,
     27            $fieldsImploded
     28        ]);
    2629        return self::_runDbDelta($sql);
    2730    }
    … …  
    3942
    4043    static function dropTable($table){
    41         $sql = "DROP TABLE IF EXISTS $table";
     44        $sql = $wpdb->prepare("DROP TABLE IF EXISTS %s", [$table]);
    4245        return self::_runQuery($sql);
    4346    }
    … …  
    6871    }
    6972
     73    static function getCol($tableName, $column, $valueLike){
     74        $sql = $wpdb->prepare('SELECT * FROM %s WHERE %s LIKE %s', [
     75            $tableName,
     76            $column,
     77            $valueLike
     78        ]);
     79    }
     80
    7081}
    7182
Note: See TracChangeset for help on using the changeset viewer.