From f85cf00884f49f5ac686a7848e770f676cce4e7a Mon Sep 17 00:00:00 2001 From: Brion Vibber Date: Fri, 30 Jun 2006 17:21:29 +0000 Subject: [PATCH] didn't get around to this before since it was PHP 4.3+ only... * Use mysql_real_escape_string instead of addslashes for string escaping in the MySQL Database class. This may fix some rare breakage with binary fields. Note that MediaWiki does not support the multibyte character sets where a "dumb" byte replacement can be actively dangerous; UTF-8 is always safe in this regard due to the bit patterns which make head and tail bytes distinct. --- RELEASE-NOTES | 7 +++++++ includes/Database.php | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/RELEASE-NOTES b/RELEASE-NOTES index cd476345e4..936c561699 100644 --- a/RELEASE-NOTES +++ b/RELEASE-NOTES @@ -606,6 +606,13 @@ Some default configuration options have changed: * (bug 6491) Apply bad image list in category galleries * (bug 6488) Show relevant log fragment in Special:Movepage * Fix potential PHP notice in Special:Blockme when $wgBlockOpenProxies is true +* Use mysql_real_escape_string instead of addslashes for string escaping in + the MySQL Database class. This may fix some rare breakage with binary fields. + Note that MediaWiki does not support the multibyte character sets where a + "dumb" byte replacement can be actively dangerous; UTF-8 is always safe + in this regard due to the bit patterns which make head and tail bytes + distinct. + == Compatibility == diff --git a/includes/Database.php b/includes/Database.php index 4ab1b984e0..3704ee274c 100644 --- a/includes/Database.php +++ b/includes/Database.php @@ -1367,7 +1367,7 @@ class Database { * @return string slashed string. */ function strencode( $s ) { - return addslashes( $s ); + return mysql_real_escape_string( $s, $this->mConn ); } /** @@ -1931,7 +1931,7 @@ class Database { // Ordinary variables foreach ( $varnames as $var ) { if( isset( $GLOBALS[$var] ) ) { - $val = addslashes( $GLOBALS[$var] ); + $val = addslashes( $GLOBALS[$var] ); // FIXME: safety check? $ins = str_replace( '{$' . $var . '}', $val, $ins ); $ins = str_replace( '/*$' . $var . '*/`', '`' . $val, $ins ); $ins = str_replace( '/*$' . $var . '*/', $val, $ins ); -- 2.20.1