From 51b7104342f3f76933b1b04e5d350f878934cbab Mon Sep 17 00:00:00 2001 From: Jakub Vrana Date: Wed, 23 Jan 2013 03:29:58 -0800 Subject: [PATCH] Allow editing function results --- adminer/include/functions.inc.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php index 86923205..876318d7 100644 --- a/adminer/include/functions.inc.php +++ b/adminer/include/functions.inc.php @@ -335,8 +335,10 @@ function unique_array($row, $indexes) { function where($where, $fields = array()) { global $jush; $return = array(); + $function_pattern = '(^[\w\(]+' . str_replace("_", ".*", preg_quote(idf_escape("_"))) . '\)+$)'; //! columns looking like functions foreach ((array) $where["where"] as $key => $val) { - $return[] = idf_escape(bracket_escape($key, 1)) // 1 - back + $key = bracket_escape($key, 1); // 1 - back + $return[] = (preg_match($function_pattern, $key) ? $key : idf_escape($key)) //! SQL injection . (($jush == "sql" && ereg('\\.', $val)) || $jush == "mssql" ? " LIKE " . exact_value(addcslashes($val, "%_\\")) : " = " . unconvert_field($fields[$key], exact_value($val))) // LIKE because of floats, but slow with ints, in MS SQL because of text ; //! enum and set }