L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'w20_MDL-32907_m23_like' of git://github.com/skodak/moodle

Browse Source
This commit is contained in:
Aparup Banerjee
2012-05-17 14:47:44 +08:00
parent 331a8feecf ed63f7f883
commit 7ded1e29f9
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/dml/pgsql_native_moodle_database.php
+6 -2
View File
@@ -1118,7 +1118,11 @@ class pgsql_native_moodle_database extends moodle_database {
if (strpos($param, '%') !== false) {
debugging('Potential SQL injection detected, sql_like() expects bound parameters (? or :named)');
}
$escapechar = pg_escape_string($this->pgsql, $escapechar); // prevents problems with C-style escapes of enclosing '\'
if ($escapechar === '\\') {
// Prevents problems with C-style escapes of enclosing '\',
// E'... bellow prevents compatibility warnings.
$escapechar = '\\\\';
}
// postgresql does not support accent insensitive text comparisons, sorry
if ($casesensitive) {
@@ -1126,7 +1130,7 @@ class pgsql_native_moodle_database extends moodle_database {
} else {
$LIKE = $notlike ? 'NOT ILIKE' : 'ILIKE';
}
return "$fieldname $LIKE $param ESCAPE '$escapechar'";
return "$fieldname $LIKE $param ESCAPE E'$escapechar'";
}
public function sql_bitxor($int1, $int2) {
lib/dml/tests/dml_test.php
+8
View File
@@ -3512,6 +3512,14 @@ class dml_testcase extends database_driver_testcase {
$records = $DB->get_records_sql($sql, array("%D%"));
$this->assertEquals(count($records), 6);
// verify usual escaping characters work fine
$sql = "SELECT * FROM {{$tablename}} WHERE ".$DB->sql_like('name', '?', true, true, false, '\\');
$records = $DB->get_records_sql($sql, array("ouc\\_"));
$this->assertEquals(count($records), 1);
$sql = "SELECT * FROM {{$tablename}} WHERE ".$DB->sql_like('name', '?', true, true, false, '|');
$records = $DB->get_records_sql($sql, array("ouc|%"));
$this->assertEquals(count($records), 1);
// TODO: we do not require accent insensitivness yet, just make sure it does not throw errors
$sql = "SELECT * FROM {{$tablename}} WHERE ".$DB->sql_like('name', '?', true, false);
$records = $DB->get_records_sql($sql, array('aui'));