From 6d92b4963f0c4fe5f8d2f25708a675086b6edc26 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Sat, 23 Jul 2005 12:16:26 +0000
Subject: [PATCH] bug #1157230, escape special chars in ENUM or SET

---
 ChangeLog              | 4 ++++
 tbl_properties.inc.php | 8 +++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index c0de70af2..a504cd417 100755
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@ phpMyAdmin - Changelog
 $Id$
 $Source$
 
+2005-07-23 Marc Delisle  <lem9@users.sourceforge.net>
+    * tbl_properties_structure.php, tbl_properties.inc.php:
+      bug #1157230, escape special chars in ENUM or SET
+
 2005-07-22 Marc Delisle  <lem9@users.sourceforge.net>
     * db_details_structure.php: table creation should not be possible
       in information_schema
diff --git a/tbl_properties.inc.php b/tbl_properties.inc.php
index 02c9b33a4..5dda87917 100644
--- a/tbl_properties.inc.php
+++ b/tbl_properties.inc.php
@@ -303,14 +303,13 @@ for ($i = 0 ; $i < $num_fields; $i++) {
         $content_cells[$i][$ci] = '';
     }
 
-    $content_cells[$i][$ci] .= "\n" . '<input id="field_' . $i . '_' . ($ci - $ci_offset) . '" type="text" name="field_length[]" size="8" value="' . str_replace('"', '&quot;', $length) . '" class="textfield" />' . "\n";
-    $ci++;
-
     if (preg_match('@^(set|enum)$@i', $type)) {
         $binary           = 0;
         $unsigned         = 0;
         $zerofill         = 0;
+        $length_to_display = htmlspecialchars($length);
     } else {
+        $length_to_display = $length;
         if (!preg_match('@BINARY[\(]@i', $row['Type']) && PMA_MYSQL_INT_VERSION < 40100) {
             $binary           = stristr($row['Type'], 'binary');
         } else {
@@ -320,6 +319,9 @@ for ($i = 0 ; $i < $num_fields; $i++) {
         $zerofill         = stristr($row['Type'], 'zerofill');
     }
 
+    $content_cells[$i][$ci] .= "\n" . '<input id="field_' . $i . '_' . ($ci - $ci_offset) . '" type="text" name="field_length[]" size="8" value="' . str_replace('"', '&quot;', $length_to_display) . '" class="textfield" />' . "\n";
+    $ci++;
+
     if (PMA_MYSQL_INT_VERSION >= 40100) {
         $tmp_collation          = empty($row['Collation']) ? NULL : $row['Collation'];
         $content_cells[$i][$ci] = PMA_generateCharsetDropdownBox(PMA_CSDROPDOWN_COLLATION, 'field_collation[]', 'field_' . $i . '_' . ($ci - $ci_offset), $tmp_collation, FALSE);