diff --git a/adminer/database.inc.php b/adminer/database.inc.php index 94615289..87f31dd7 100644 --- a/adminer/database.inc.php +++ b/adminer/database.inc.php @@ -28,7 +28,7 @@ if ($_POST && !$error && !isset($_POST["add_x"])) { // add is an image and PHP c if (!$_POST["collation"]) { redirect(substr(ME, 0, -1)); } - query_redirect("ALTER DATABASE " . idf_escape($_POST["name"]) . (eregi('^[a-z0-9_]+$', $_POST["collation"]) ? " COLLATE $_POST[collation]" : ""), substr(ME, 0, -1), lang('Database has been altered.')); //! SQL injection - quotes are not allowed in MS SQL 2005 + query_redirect("ALTER DATABASE " . idf_escape($_POST["name"]) . (eregi('^[a-z0-9_]+$', $_POST["collation"]) ? " COLLATE $_POST[collation]" : ""), substr(ME, 0, -1), lang('Database has been altered.')); } } diff --git a/readme.txt b/readme.txt index ad3301a4..02f0c70a 100644 --- a/readme.txt +++ b/readme.txt @@ -1,5 +1,5 @@ Adminer - Database management in single PHP file -Adminer Editor - Database editor in single PHP file +Adminer Editor - Data manipulation for end-users http://www.adminer.org/ Supports: MySQL, PostgreSQL, SQLite, MS SQL, Oracle @@ -8,6 +8,7 @@ Apache License, Version 2.0 adminer/index.php - Run development version of Adminer editor/index.php - Run development version of Adminer Editor +editor/example.php - Example customization compile.php [driver] [lang] - Create a single file version lang.php [lang] - Update translations tests/selenium.html - Selenium test suite