From 68b1465cab0805f42facbbc76acf68e51889ccbf Mon Sep 17 00:00:00 2001 From: Till Brehm Date: Thu, 16 Oct 2014 12:04:50 +0200 Subject: [PATCH] Changes in SQL injection check of database library. --- interface/lib/classes/db_mysql.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/interface/lib/classes/db_mysql.inc.php b/interface/lib/classes/db_mysql.inc.php index bcf1b008a..d4ba79c59 100644 --- a/interface/lib/classes/db_mysql.inc.php +++ b/interface/lib/classes/db_mysql.inc.php @@ -135,7 +135,7 @@ class db extends mysqli $string_orig = $string; //echo $string; - $chars = array(';', '#', '/*', '*/', '--', ' UNION ', '\\\'', '\\"'); + $chars = array(';', '#', '/*', '*/', '--', '\\\'', '\\"'); $string = str_replace('\\\\', '', $string); $string = preg_replace('/(^|[^\\\])([\'"])\\2/is', '$1', $string); -- GitLab