EZPDO » EZPDO Bug Tracking

Task #235 — query does not honor the slashed single quote

Attached to Project— EZPDO

Opened by Fenumeor (Fenumeor) - Thursday, 25 Oct 2007, 10:13am

Details

For example:

$_POST['keyword'] = "a\\' b c";

$data = $this->db->find("from Dwelling where title like '".$_POST['keyword']."'");

the resulting sql is like this:

SELECT DISTINCT _1.* FROM "ezpdo_Dwelling" AS "_1" WHERE "_1"."title" LIKE 'a\''bc'

which is absolutely not as expected.

I think this is pretty critical, as it could allow SQL injection.

This task depends upon

This task blocks these from closing

Username	Password	Remember me
Register as a new user \| Lost password?