makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/15311] Escape file_name in sql query

Browse source 
PHPBB3-15311
This commit is contained in:
Rubén Calvo 2018-05-08 14:13:10 +02:00
parent 4ebded01b9
commit 01f88fd269
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
phpBB/includes/acp/acp_database.php
View file

@ -289,7 +289,7 @@ class acp_database
// Remove from database // Remove from database
$sql = "DELETE FROM " . $table_prefix . "backups $sql = "DELETE FROM " . $table_prefix . "backups
WHERE filename = '" . $file_name . "';"; WHERE filename = '" . $db->sql_escape($file_name) . "';";
$db->sql_query($sql); $db->sql_query($sql);
} }
catch (\Exception $e) catch (\Exception $e)