diff --git a/lib/adodb/adodb.inc.php b/lib/adodb/adodb.inc.php index 9a619ffb5b5..06289a5495a 100644 --- a/lib/adodb/adodb.inc.php +++ b/lib/adodb/adodb.inc.php @@ -2604,7 +2604,9 @@ http://www.stanford.edu/dept/itss/docs/oracle/10g/server.101/b10759/statements_1 // undo magic quotes for " $s = str_replace('\\"','"',$s); - if ($this->replaceQuote == "\\'") // ' already quoted, no need to change anything + // moodle change start - see readme_moodle.txt + if ($this->replaceQuote == "\\'" || ini_get('magic_quotes_sybase')) // ' already quoted, no need to change anything + // moodle change end - see readme_moodle.txt return $s; else {// change \' to '' for sybase/mssql $s = str_replace('\\\\','\\',$s); @@ -2638,7 +2640,9 @@ http://www.stanford.edu/dept/itss/docs/oracle/10g/server.101/b10759/statements_1 // undo magic quotes for " $s = str_replace('\\"','"',$s); - if ($this->replaceQuote == "\\'") // ' already quoted, no need to change anything + // moodle change start - see readme_moodle.txt + if ($this->replaceQuote == "\\'" || ini_get('magic_quotes_sybase')) // ' already quoted, no need to change anything + // moodle change end - see readme_moodle.txt return "'$s'"; else {// change \' to '' for sybase/mssql $s = str_replace('\\\\','\\',$s); diff --git a/lib/adodb/drivers/adodb-mssql.inc.php b/lib/adodb/drivers/adodb-mssql.inc.php index 65a1c20eb6e..7cf51201dfb 100644 --- a/lib/adodb/drivers/adodb-mssql.inc.php +++ b/lib/adodb/drivers/adodb-mssql.inc.php @@ -738,6 +738,46 @@ order by constraint_name, referenced_table_name, keyno"; } return $rez; } + +// moodle change start - see readme_moodle.txt + /** + * Correctly quotes a string so that all strings are escaped. We prefix and append + * to the string single-quotes. + * An example is $db->qstr("Don't bother",magic_quotes_runtime()); + * + * @param s the string to quote + * @param [magic_quotes] if $s is GET/POST var, set to get_magic_quotes_gpc(). + * This undoes the stupidity of magic quotes for GPC. + * + * @return quoted string to be sent back to database + */ + function qstr($s,$magic_quotes=false) + { + if (!$magic_quotes) { + + if ($this->replaceQuote[0] == '\\'){ + // only since php 4.0.5 + $s = adodb_str_replace(array('\\',"\0"),array('\\\\',"\\\0"),$s); + //$s = str_replace("\0","\\\0", str_replace('\\','\\\\',$s)); + } + return "'".str_replace("'",$this->replaceQuote,$s)."'"; + } + + // undo magic quotes for " unless sybase is on + $sybase = ini_get('magic_quotes_sybase'); + if (!$sybase) { + $s = str_replace('\\"','"',$s); + if ($this->replaceQuote == "\\'") // ' already quoted, no need to change anything + return "'$s'"; + else {// change \' to '' for sybase/mssql + $s = str_replace('\\\\','\\',$s); + return "'".str_replace("\\'",$this->replaceQuote,$s)."'"; + } + } else { + return "'".$s."'"; + } + } +// moodle change end - see readme_moodle.txt // returns true or false function _close() @@ -1061,4 +1101,4 @@ order by constraint_name, ordinal_position http://www.databasejournal.com/scripts/article.php/1440551 */ -?> \ No newline at end of file +?> diff --git a/lib/adodb/drivers/adodb-oci8.inc.php b/lib/adodb/drivers/adodb-oci8.inc.php index da7bbb6865b..45dff8d1059 100644 --- a/lib/adodb/drivers/adodb-oci8.inc.php +++ b/lib/adodb/drivers/adodb-oci8.inc.php @@ -1282,13 +1282,18 @@ SELECT /*+ RULE */ distinct b.column_name } return "'".str_replace("'",$this->replaceQuote,$s)."'"; } +// moodle change start - see readme_moodle.txt - // undo magic quotes for " - $s = str_replace('\\"','"',$s); - - $s = str_replace('\\\\','\\',$s); - return "'".str_replace("\\'",$this->replaceQuote,$s)."'"; - + // undo magic quotes for " unless sybase is on + $sybase = ini_get('magic_quotes_sybase'); + if (!$sybase) { + $s = str_replace('\\"','"',$s); + $s = str_replace('\\\\','\\',$s); + return "'".str_replace("\\'",$this->replaceQuote,$s)."'"; + } else { + return "'".$s."'"; + } +// moodle change end - see readme_moodle.txt } } diff --git a/lib/adodb/readme_moodle.txt b/lib/adodb/readme_moodle.txt index 2c84c58531b..c4a38e7fe2c 100644 --- a/lib/adodb/readme_moodle.txt +++ b/lib/adodb/readme_moodle.txt @@ -18,6 +18,11 @@ Our changes: /// Look for "moodle" in adodb code * adodb-lib.inc.php - modify some debug output to be correct XHTML. MDL-12378. Reported to ADOdb at: http://phplens.com/lens/lensforum/msgs.php?id=17133 Once fixed by adodb guys, we'll return to their official distro. + * drivers/adodb-mssql.inc.php, drivers/adodb-oci8.inc.php (qstr) and + adodb.inc.php (addq and qstr) - fixed wrong "undo magic quotes" that was + ignoring "magic_quotes_sybase" and leading to wrongly escaped contents. MDL-19452 + Reported privately to John Lim, will be added to upstream soon. Once fixed + we'll return to their official distro. skodak, iarenaza, moodler, stronk7