Skip to content

Commit 142f15f

Browse files
kamil-tekielakamil-tekiela
authored
Use quoteString in controllers (#18191)
* CreateController Signed-off-by: Kamil Tekiela <tekiela246@gmail.com> * FindReplaceController Signed-off-by: Kamil Tekiela <tekiela246@gmail.com> * SetVariableController Signed-off-by: Kamil Tekiela <tekiela246@gmail.com> * GetVariableController Signed-off-by: Kamil Tekiela <tekiela246@gmail.com> * UserGroupsFormController Signed-off-by: Kamil Tekiela <tekiela246@gmail.com> * TablesController Signed-off-by: Kamil Tekiela <tekiela246@gmail.com> --------- Signed-off-by: Kamil Tekiela <tekiela246@gmail.com>
1 parent df9d76e commit 142f15f

File tree

9 files changed

+26
-61
lines changed

9 files changed

+26
-61
lines changed

‎libraries/classes/Controllers/Database/MultiTableQuery/TablesController.php‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@
1111
use PhpMyAdmin\ResponseRenderer;
1212
use PhpMyAdmin\Template;
1313

14-
use function rtrim;
14+
use function array_map;
15+
use function implode;
1516

1617
final class TablesController extends AbstractController
1718
{
@@ -27,17 +28,12 @@ public function __invoke(ServerRequest $request): void
2728
/** @var string $db */
2829
$db = $request->getQueryParam('db', '');
2930

30-
$tablesListForQuery = '';
31-
foreach ($tables as $table) {
32-
$tablesListForQuery .= "'" . $this->dbi->escapeString($table) . "',";
33-
}
34-
35-
$tablesListForQuery = rtrim($tablesListForQuery, ',');
31+
$tablesListForQuery = array_map($this->dbi->quoteString(...), $tables);
3632

3733
$constrains = $this->dbi->fetchResult(
3834
QueryGenerator::getInformationSchemaForeignKeyConstraintsRequest(
39-
$this->dbi->escapeString($db),
40-
$tablesListForQuery,
35+
$this->dbi->quoteString($db),
36+
implode(',', $tablesListForQuery),
4137
),
4238
);
4339
$this->response->addJSON(['foreignKeyConstrains' => $constrains]);

‎libraries/classes/Controllers/Server/UserGroupsFormController.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,9 +74,9 @@ private function getHtmlToChooseUserGroup(
7474
. '.' . Util::backquote($configurableMenusFeature->users);
7575

7676
$sqlQuery = sprintf(
77-
'SELECT `usergroup` FROM %s WHERE `username` = \'%s\'',
77+
'SELECT `usergroup` FROM %s WHERE `username` = %s',
7878
$userTable,
79-
$this->dbi->escapeString($username),
79+
$this->dbi->quoteString($username),
8080
);
8181
$userGroup = $this->dbi->fetchValue($sqlQuery, 0, Connection::TYPE_CONTROL);
8282

‎libraries/classes/Controllers/Server/Variables/GetVariableController.php‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,9 @@ public function __invoke(ServerRequest $request, array $params): void
3131

3232
// Send with correct charset
3333
header('Content-Type: text/html; charset=UTF-8');
34-
// Do not use double quotes inside the query to avoid a problem
35-
// when server is running in ANSI_QUOTES sql_mode
3634
$varValue = $this->dbi->fetchSingleRow(
37-
'SHOW GLOBAL VARIABLES WHERE Variable_name=\''
38-
. $this->dbi->escapeString($params['name']) . '\';',
35+
'SHOW GLOBAL VARIABLES WHERE Variable_name='
36+
. $this->dbi->quoteString($params['name']) . ';',
3937
DatabaseInterface::FETCH_NUM,
4038
);
4139

‎libraries/classes/Controllers/Server/Variables/SetVariableController.php‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -60,21 +60,17 @@ public function __invoke(ServerRequest $request, array $vars): void
6060
];
6161
$value = (float) $matches[1] * 1024 ** $exp[mb_strtolower($matches[3])];
6262
} else {
63-
$value = $this->dbi->escapeString($value);
64-
}
65-
66-
if (! is_numeric($value)) {
67-
$value = "'" . $value . "'";
63+
$value = $this->dbi->quoteString($value);
6864
}
6965

7066
$json = [];
7167
if (! preg_match('/[^a-zA-Z0-9_]+/', $variableName)) {
7268
$this->dbi->query('SET GLOBAL ' . $variableName . ' = ' . $value);
7369
// Some values are rounded down etc.
7470
$varValue = $this->dbi->fetchSingleRow(
75-
'SHOW GLOBAL VARIABLES WHERE Variable_name="'
76-
. $this->dbi->escapeString($variableName)
77-
. '";',
71+
'SHOW GLOBAL VARIABLES WHERE Variable_name='
72+
. $this->dbi->quoteString($variableName)
73+
. ';',
7874
DatabaseInterface::FETCH_NUM,
7975
);
8076
[$formattedValue, $isHtmlFormatted] = $this->formatVariable($variableName, $varValue[1]);

‎libraries/classes/Controllers/Table/FindReplaceController.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ private function getRegexReplaceRows(
250250
. ' FROM ' . Util::backquote($GLOBALS['db'])
251251
. '.' . Util::backquote($GLOBALS['table'])
252252
. ' WHERE ' . Util::backquote($column)
253-
. " RLIKE '" . $this->dbi->escapeString($find) . "' COLLATE "
253+
. ' RLIKE ' . $this->dbi->quoteString($find) . ' COLLATE '
254254
. $charSet . '_bin'; // here we
255255
// change the collation of the 2nd operand to a case sensitive
256256
// binary collation to make sure that the comparison is case sensitive
@@ -313,8 +313,8 @@ public function replace(
313313
$sql_query .= ' = CASE';
314314
foreach ($toReplace as $row) {
315315
$sql_query .= "\n WHEN " . Util::backquote($column)
316-
. " = '" . $this->dbi->escapeString($row[0])
317-
. "' THEN '" . $this->dbi->escapeString($row[1]) . "'";
316+
. ' = ' . $this->dbi->quoteString($row[0])
317+
. ' THEN ' . $this->dbi->quoteString($row[1]);
318318
}
319319

320320
$sql_query .= ' END';
@@ -324,7 +324,7 @@ public function replace(
324324
}
325325

326326
$sql_query .= ' WHERE ' . Util::backquote($column)
327-
. " RLIKE '" . $this->dbi->escapeString($find) . "' COLLATE "
327+
. ' RLIKE ' . $this->dbi->quoteString($find) . ' COLLATE '
328328
. $charSet . '_bin'; // here we
329329
// change the collation of the 2nd operand to a case sensitive
330330
// binary collation to make sure that the comparison

‎libraries/classes/Controllers/View/CreateController.php‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -134,13 +134,12 @@ public function __invoke(ServerRequest $request): void
134134
if (isset($_GET['db'], $_GET['table'])) {
135135
$item = $this->dbi->fetchSingleRow(
136136
sprintf(
137-
"SELECT `VIEW_DEFINITION`, `CHECK_OPTION`, `DEFINER`,
138-
`SECURITY_TYPE`
139-
FROM `INFORMATION_SCHEMA`.`VIEWS`
140-
WHERE TABLE_SCHEMA='%s'
141-
AND TABLE_NAME='%s';",
142-
$this->dbi->escapeString($_GET['db']),
143-
$this->dbi->escapeString($_GET['table']),
137+
'SELECT `VIEW_DEFINITION`, `CHECK_OPTION`, `DEFINER`, `SECURITY_TYPE`
138+
FROM `INFORMATION_SCHEMA`.`VIEWS`
139+
WHERE TABLE_SCHEMA=%s
140+
AND TABLE_NAME=%s;',
141+
$this->dbi->quoteString($_GET['db']),
142+
$this->dbi->quoteString($_GET['table']),
144143
),
145144
);
146145
$createView = $this->dbi->getTable($_GET['db'], $_GET['table'])

‎libraries/classes/Query/Generator.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ public static function getInformationSchemaForeignKeyConstraintsRequest(
258258
. ' REFERENCED_COLUMN_NAME'
259259
. ' FROM information_schema.key_column_usage'
260260
. ' WHERE referenced_table_name IS NOT NULL'
261-
. " AND TABLE_SCHEMA = '" . $escapedDatabase . "'"
261+
. ' AND TABLE_SCHEMA = ' . $escapedDatabase
262262
. ' AND TABLE_NAME IN (' . $tablesListForQueryCsv . ')'
263263
. ' AND REFERENCED_TABLE_NAME IN (' . $tablesListForQueryCsv . ');';
264264
}

‎psalm-baseline.xml‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1231,10 +1231,6 @@
12311231
</MixedArgument>
12321232
</file>
12331233
<file src="libraries/classes/Controllers/Database/MultiTableQuery/TablesController.php">
1234-
<DeprecatedMethod>
1235-
<code>escapeString</code>
1236-
<code>escapeString</code>
1237-
</DeprecatedMethod>
12381234
<PossiblyUnusedMethod>
12391235
<code>__construct</code>
12401236
</PossiblyUnusedMethod>
@@ -3139,9 +3135,6 @@
31393135
</PossiblyUnusedMethod>
31403136
</file>
31413137
<file src="libraries/classes/Controllers/Server/UserGroupsFormController.php">
3142-
<DeprecatedMethod>
3143-
<code>escapeString</code>
3144-
</DeprecatedMethod>
31453138
<PossiblyInvalidArgument>
31463139
<code>$username</code>
31473140
</PossiblyInvalidArgument>
@@ -3160,9 +3153,6 @@
31603153
</UnusedParam>
31613154
</file>
31623155
<file src="libraries/classes/Controllers/Server/Variables/GetVariableController.php">
3163-
<DeprecatedMethod>
3164-
<code>escapeString</code>
3165-
</DeprecatedMethod>
31663156
<MixedArgument>
31673157
<code><![CDATA[$params['name']]]></code>
31683158
<code><![CDATA[$params['name']]]></code>
@@ -3179,10 +3169,6 @@
31793169
</UnusedParam>
31803170
</file>
31813171
<file src="libraries/classes/Controllers/Server/Variables/SetVariableController.php">
3182-
<DeprecatedMethod>
3183-
<code>escapeString</code>
3184-
<code>escapeString</code>
3185-
</DeprecatedMethod>
31863172
<MixedArgument>
31873173
<code>$formattedValue</code>
31883174
<code>$varValue[1]</code>
@@ -3644,12 +3630,6 @@
36443630
</MixedAssignment>
36453631
</file>
36463632
<file src="libraries/classes/Controllers/Table/FindReplaceController.php">
3647-
<DeprecatedMethod>
3648-
<code>escapeString</code>
3649-
<code>escapeString</code>
3650-
<code>escapeString</code>
3651-
<code>escapeString</code>
3652-
</DeprecatedMethod>
36533633
<InvalidArgument>
36543634
<code><![CDATA[$_POST['columnIndex']]]></code>
36553635
<code><![CDATA[$_POST['columnIndex']]]></code>
@@ -4721,10 +4701,6 @@
47214701
</PossiblyUnusedParam>
47224702
</file>
47234703
<file src="libraries/classes/Controllers/View/CreateController.php">
4724-
<DeprecatedMethod>
4725-
<code>escapeString</code>
4726-
<code>escapeString</code>
4727-
</DeprecatedMethod>
47284704
<DocblockTypeContradiction>
47294705
<code><![CDATA[$viewData['as']]]></code>
47304706
</DocblockTypeContradiction>

‎test/classes/Controllers/Table/FindReplaceControllerTest.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,8 @@ protected function setUp(): void
6464

6565
$dbi->expects($this->any())->method('fetchValue')
6666
->will($this->returnValue($show_create_table));
67-
$dbi->expects($this->any())->method('escapeString')
68-
->will($this->returnArgument(0));
67+
$dbi->expects($this->any())->method('quoteString')
68+
->will($this->returnCallback(static fn (string $string): string => "'" . $string . "'"));
6969

7070
$GLOBALS['dbi'] = $dbi;
7171
}

0 commit comments

Comments
 (0)