diff options
| -rw-r--r-- | plugins/virtuser_query/virtuser_query.php | 6 | ||||
| -rw-r--r-- | program/lib/Roundcube/rcube_db.php | 28 |
2 files changed, 25 insertions, 9 deletions
diff --git a/plugins/virtuser_query/virtuser_query.php b/plugins/virtuser_query/virtuser_query.php index 32522f9d0..9e3dc9071 100644 --- a/plugins/virtuser_query/virtuser_query.php +++ b/plugins/virtuser_query/virtuser_query.php @@ -59,7 +59,7 @@ class virtuser_query extends rcube_plugin { $dbh = $this->get_dbh(); - $sql_result = $dbh->query(preg_replace('/%u/', $dbh->quote($p['user']), $this->config['email'])); + $sql_result = $dbh->query(preg_replace('/%u/', $dbh->escape($p['user']), $this->config['email'])); while ($sql_arr = $dbh->fetch_array($sql_result)) { if (strpos($sql_arr[0], '@')) { @@ -96,7 +96,7 @@ class virtuser_query extends rcube_plugin { $dbh = $this->get_dbh(); - $sql_result = $dbh->query(preg_replace('/%m/', $dbh->quote($p['email']), $this->config['user'])); + $sql_result = $dbh->query(preg_replace('/%m/', $dbh->escape($p['email']), $this->config['user'])); if ($sql_arr = $dbh->fetch_array($sql_result)) { $p['user'] = $sql_arr[0]; @@ -112,7 +112,7 @@ class virtuser_query extends rcube_plugin { $dbh = $this->get_dbh(); - $sql_result = $dbh->query(preg_replace('/%u/', $dbh->quote($p['user']), $this->config['host'])); + $sql_result = $dbh->query(preg_replace('/%u/', $dbh->escape($p['user']), $this->config['host'])); if ($sql_arr = $dbh->fetch_array($sql_result)) { $p['host'] = $sql_arr[0]; diff --git a/program/lib/Roundcube/rcube_db.php b/program/lib/Roundcube/rcube_db.php index a9163cbd7..9cda023bf 100644 --- a/program/lib/Roundcube/rcube_db.php +++ b/program/lib/Roundcube/rcube_db.php @@ -634,6 +634,22 @@ class rcube_db } /** + * Escapes a string so it can be safely used in a query + * + * @param string $str A string to escape + * + * @return string Escaped string for use in a query + */ + public function escape($str) + { + if (is_null($str)) { + return 'NULL'; + } + + return substr($this->quote($str), 1, -1); + } + + /** * Quotes a string so it can be safely used as a table or column name * * @param string $str Value to quote @@ -648,17 +664,17 @@ class rcube_db } /** - * Quotes a string so it can be safely used as a table or column name + * Escapes a string so it can be safely used in a query * - * @param string $str Value to quote + * @param string $str A string to escape * - * @return string Quoted string for use in query - * @deprecated Replaced by rcube_db::quote - * @see rcube_db::quote + * @return string Escaped string for use in a query + * @deprecated Replaced by rcube_db::escape + * @see rcube_db::escape */ public function escapeSimple($str) { - return $this->quote($str); + return $this->escape($str); } /** |