pass unescaped query string to Database::insert(), double escaping is not needed
authorDomas Mituzas <midom@users.mediawiki.org>
Thu, 30 Sep 2004 14:40:06 +0000 (14:40 +0000)
committerDomas Mituzas <midom@users.mediawiki.org>
Thu, 30 Sep 2004 14:40:06 +0000 (14:40 +0000)
includes/Profiling.php

index 48129ec..cf0cc42 100755 (executable)
@@ -179,11 +179,12 @@ class Profiler
                $dbw =& wfGetDB( DB_MASTER );
                $profiling = $dbw->tableName( 'profiling' );
 
-               $name = substr($dbw->strencode( $name ),0,255);
+               $name = substr($name,0,255);
+               $encname = $dbw->strencode($name);
                $sql = "UPDATE $profiling ".
                        "SET pf_count=pf_count+{$eventCount}, ".
                        "pf_time=pf_time + {$timeSum} ".
-                       "WHERE pf_name='{$name}'";
+                       "WHERE pf_name='{$encname}'";
                $dbw->query($sql);
 
                $rc = $dbw->affectedRows();