diff --git a/adminer/include/adminer.inc.php b/adminer/include/adminer.inc.php index 9a0f08b1..02d4f584 100644 --- a/adminer/include/adminer.inc.php +++ b/adminer/include/adminer.inc.php @@ -166,6 +166,33 @@ function adminer_edit_input($table, $field) { return call_adminer('edit_input', false, $table, $field); } +/** Process sent input +* @param string field name +* @param array single field from fields() +* @return string expression to use in a query +*/ +function adminer_process_input($name, $field) { + global $dbh; + $idf = bracket_escape($name); + $function = $_POST["function"][$idf]; + $value = $_POST["fields"][$idf]; + $return = $dbh->quote($value); + if (ereg('^(now|uuid)$', $function)) { + $return = "$function()"; + } elseif (ereg('^[+-]$', $function)) { + $return = idf_escape($name) . " $function $return"; + } elseif (ereg('^[+-] interval$', $function)) { + $return = idf_escape($name) . " $function " . (preg_match("~^([0-9]+|'[0-9.: -]') [A-Z_]+$~i", $value) ? $value : $return); + } elseif (ereg('^(addtime|subtime)$', $function)) { + $return = "$function(" . idf_escape($name) . ", $return)"; + } elseif (ereg('^(md5|sha1|password)$', $function)) { + $return = "$function($return)"; + } elseif (ereg('date|time', $field["type"]) && $value == "CURRENT_TIMESTAMP") { + $return = $value; + } + return call_adminer('process_input', $return, $name, $field); +} + /** Prints navigation after Adminer title * @param string can be "auth" if there is no database connection or "db" if there is no database selected * @return bool true if default navigation should be printed diff --git a/adminer/include/functions.inc.php b/adminer/include/functions.inc.php index 153fa60a..67760468 100644 --- a/adminer/include/functions.inc.php +++ b/adminer/include/functions.inc.php @@ -339,20 +339,8 @@ function process_input($name, $field) { return false; //! report errors } return "_binary" . $dbh->quote($file); - } elseif (ereg('^(now|uuid)$', $function)) { - return "$function()"; - } elseif (ereg('^[+-]$', $function)) { - return idf_escape($name) . " $function " . $dbh->quote($value); - } elseif (ereg('^[+-] interval$', $function)) { - return idf_escape($name) . " $function " . (preg_match("~^([0-9]+|'[0-9.: -]') [A-Z_]+$~i", $value) ? $value : $dbh->quote($value)); - } elseif (ereg('^(addtime|subtime)$', $function)) { - return "$function(" . idf_escape($name) . ", " . $dbh->quote($value) . ")"; - } elseif (ereg('^(md5|sha1|password)$', $function)) { - return "$function(" . $dbh->quote($value) . ")"; - } elseif ($field["type"] == "timestamp" && $value == "CURRENT_TIMESTAMP") { - return $value; } else { - return $dbh->quote($value); + return adminer_process_input($name, $field); } } diff --git a/editor/include/adminer.inc.php b/editor/include/adminer.inc.php index 27f75fe2..b9ae9c3d 100644 --- a/editor/include/adminer.inc.php +++ b/editor/include/adminer.inc.php @@ -146,6 +146,25 @@ function adminer_edit_input($table, $field) { return call_adminer('edit_input', $return, $table, $field); } +/** Process sent input +* @param string field name +* @param array single field from fields() +* @return string expression to use in a query +*/ +function adminer_process_input($name, $field) { + global $dbh; + $idf = bracket_escape($name); + $function = $_POST["function"][$idf]; + $value = $_POST["fields"][$idf]; + $return = $dbh->quote($value); + if (!ereg('varchar|text', $field["type"]) && !strlen($value)) { + $return = "NULL"; + } elseif (ereg('date|time', $field["type"]) && $value == "CURRENT_TIMESTAMP") { + $return = $value; + } + return call_adminer('process_input', $return, $name, $field); +} + function adminer_navigation($missing) { global $SELF; if (call_adminer('navigation', true, $missing) && $missing != "auth") {