- fixed sql injection regex

fc0a1c8d · Marius Cramer · f9529b33 · fc0a1c8d
Commit fc0a1c8d authored Aug 25, 2014 by Marius Cramer
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

interface/lib/classes/db_mysql.inc.php interface/lib/classes/db_mysql.inc.php +1 -1

No files found.
--- a/interface/lib/classes/db_mysql.inc.php
+++ b/interface/lib/classes/db_mysql.inc.php
@@ -138,7 +138,7 @@ class db extends mysqli
 				$chars = array(';', '#', '/*', '*/', '--', ' UNION ', '\\\'', '\\"');
 		
 				$string = str_replace('\\\\', '', $string);
-				$string = preg_replace('/(^|[^\\\])([\'"])(.*?[^\\\])\\2/is', '$1', $string);
+				$string = preg_replace('/(^|[^\\\])([\'"])(.*?[^\\\]?)\\2/is', '$1', $string);
 				$ok = true;

 				if(substr_count($string, "`") % 2 != 0 || substr_count($string, "'") % 2 != 0 || substr_count($string, '"') % 2 != 0) {