From 9cb587c95301b8a7be4d5232a7dc4f27a1aa0540 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Mon, 14 Apr 2003 10:46:42 +0000
Subject: [PATCH] Fixed for quotes, HTML entities and other weird characters in
 db/table name.

---
 ChangeLog       |  2 ++
 footer.inc.php3 | 20 +++++++++++---------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 9e8137d5f..c2396c87f 100755
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,6 +19,8 @@ $Source$
     * lang/indonesian: Updted, thanks to Rachim Tamsjadi (tamsy).
     * lang/swedish: Updated, thanks to Björn T. Hallberg (bth).
     * lang/italian: Updated, thanks to Pietro Danesi (danone).
+    * footer.inc.php3: Fixed for quotes, HTML entities and other weird
+      characters in db/table name.
 
 2003-04-14 Garvin Hicking <me@supergarv.de>
     * libraries/common.lib.php3: Fixed SHOW TABLE STATUS LIKE ... FROM ...
diff --git a/footer.inc.php3 b/footer.inc.php3
index 3d1a0b90a..fcf51ee9a 100755
--- a/footer.inc.php3
+++ b/footer.inc.php3
@@ -12,29 +12,30 @@
 // If query window is wanted and open, update with latest selected db/table.
 if ($cfg['QueryFrame'] && $cfg['QueryFrameJS']) {
 ?>
-<script>
+<script type="text/javascript">
+<!--
 <?php
     if ($cfg['QueryFrameDebug']) {
     ?>
-        document.writeln("Updating query window. DB: <?php echo (isset($db) ? $db : 'FALSE'); ?>, Table: <?php echo (isset($table) ? $table : 'FALSE'); ?><br>");
+        document.writeln("Updating query window. DB: <?php echo (isset($db) ? addslashes($db) : 'FALSE'); ?>, Table: <?php echo (isset($table) ? addslashes($table) : 'FALSE'); ?><br>");
         document.writeln("Window: " + top.frames.queryframe.querywindow.location + "<br>");
     <?php
     }
     ?>
     
     if (top.frames.queryframe && top.frames.queryframe.document && top.frames.queryframe.document.queryframeform) {
-        top.frames.queryframe.document.queryframeform.db.value = "<?php echo (isset($db) ? htmlspecialchars($db) : ''); ?>";
-        top.frames.queryframe.document.queryframeform.table.value = "<?php echo (isset($table) ? htmlspecialchars($table) : ''); ?>";
+        top.frames.queryframe.document.queryframeform.db.value = "<?php echo (isset($db) ? addslashes($db) : ''); ?>";
+        top.frames.queryframe.document.queryframeform.table.value = "<?php echo (isset($table) ? addslashes($table) : ''); ?>";
     }
 
     function reload_querywindow () {
         if (top.frames.queryframe && top.frames.queryframe.querywindow && !top.frames.queryframe.querywindow.closed && top.frames.queryframe.querywindow.location) {
             <?php echo ($cfg['QueryFrameDebug'] ? 'document.writeln("<a href=\'#\' onClick=\'top.frames.queryframe.querywindow.focus(); return false;\'>Query Window</a> can be updated.<br>");' : ''); ?>
     
-            top.frames.queryframe.querywindow.document.querywindow.db.value = "<?php echo (isset($db) ? htmlspecialchars($db) : '') ?>";
-            top.frames.queryframe.querywindow.document.querywindow.query_history_latest_db.value = "<?php echo (isset($db) ? htmlspecialchars($db) : '') ?>";
-            top.frames.queryframe.querywindow.document.querywindow.table.value = "<?php echo (isset($table) ? htmlspecialchars($table) : '') ?>";
-            top.frames.queryframe.querywindow.document.querywindow.query_history_latest_table.value = "<?php echo (isset($table) ? htmlspecialchars($table) : '') ?>";
+            top.frames.queryframe.querywindow.document.querywindow.db.value = "<?php echo (isset($db) ? addslashes($db) : '') ?>";
+            top.frames.queryframe.querywindow.document.querywindow.query_history_latest_db.value = "<?php echo (isset($db) ? addslashes($db) : '') ?>";
+            top.frames.queryframe.querywindow.document.querywindow.table.value = "<?php echo (isset($table) ? addslashes($table) : '') ?>";
+            top.frames.queryframe.querywindow.document.querywindow.query_history_latest_table.value = "<?php echo (isset($table) ? addslashes($table) : '') ?>";
     
             <?php echo (isset($sql_query) ? 'top.frames.queryframe.querywindow.document.querywindow.query_history_latest.value = "' . urlencode($sql_query) . '";' : '// no sql query update') . "\n"; ?>
     
@@ -48,7 +49,7 @@ if ($cfg['QueryFrame'] && $cfg['QueryFrameJS']) {
             top.frames.queryframe.querywindow.focus();
             return false;
         } else if (top.frames.queryframe) {
-            new_win_url = 'querywindow.php3?sql_query=' + sql_query + '&<?php echo PMA_generate_common_url(isset($db) ? $db : '', isset($table) ? $table : '', '&'); ?>';
+            new_win_url = 'querywindow.php3?sql_query=' + sql_query + '&<?php echo PMA_generate_common_url(isset($db) ? addslashes($db) : '', isset($table) ? addslashes($table) : '', '&'); ?>';
             top.frames.queryframe.querywindow=window.open(new_win_url, 'js_querywindow','toolbar=0,location=1,directories=0,status=1,menubar=0,scrollbars=yes,resizable=yes,width=<?php echo $cfg['QueryWindowWidth']; ?>,height=<?php echo $cfg['QueryWindowHeight']; ?>');
     
             if (!top.frames.queryframe.querywindow.opener) {
@@ -62,6 +63,7 @@ if ($cfg['QueryFrame'] && $cfg['QueryFrameJS']) {
 
     reload_querywindow();
     self.focus();
+//-->
 </script>
 <?php
 }