diff --git a/ChangeLog b/ChangeLog index f6c0f7388..7326f6140 100755 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,8 @@ $Source$ 2003-10-11 Marc Delisle * libraries/grab_globals.lib.php3: bug 807047, better fix + * tbl_select.php3: bug 821350: escape single quotes in table + Search page 2003-10-10 Marc Delisle * footer.inc.php3: bug 819036, undefined function PMA_setHistory() diff --git a/tbl_select.php3 b/tbl_select.php3 index 8ce9129eb..b602308aa 100755 --- a/tbl_select.php3 +++ b/tbl_select.php3 @@ -277,7 +277,10 @@ else { $quot = ''; $func[$i] = 'IS'; } - $sql_query .= ' AND ' . PMA_backquote(urldecode($names[$i])) . " $func[$i] $quot$fields[$i]$quot"; + //$sql_query .= ' AND ' . PMA_backquote(urldecode($names[$i])) . " $func[$i] $quot$fields[$i]$quot"; + + $sql_query .= ' AND ' . PMA_backquote(urldecode($names[$i])) . ' ' . $func[$i] . ' ' . $quot . PMA_sqlAddslashes($fields[$i]) . $quot; + } // end if } // end for } // end if