فهرست منبع

[#372] Quote null byte characters

- Implements a patch that ensures that null byte characters are properly quoted
  in the SQL Server adapter.
Matthew Weier O'Phinney 11 سال پیش
والد
کامیت
a784d7e355
2فایلهای تغییر یافته به همراه12 افزوده شده و 0 حذف شده
  1. 1 0
      library/Zend/Db/Adapter/Sqlsrv.php
  2. 11 0
      tests/Zend/Db/Adapter/SqlsrvTest.php

+ 1 - 0
library/Zend/Db/Adapter/Sqlsrv.php

@@ -314,6 +314,7 @@ class Zend_Db_Adapter_Sqlsrv extends Zend_Db_Adapter_Abstract
             return sprintf('%F', $value);
         }
 
+        $value = addcslashes($value, "\000\032");
         return "'" . str_replace("'", "''", $value) . "'";
     }
 

+ 11 - 0
tests/Zend/Db/Adapter/SqlsrvTest.php

@@ -558,4 +558,15 @@ class Zend_Db_Adapter_SqlsrvTest extends Zend_Db_Adapter_TestCommon
     {
         return 'Sqlsrv';
     }
+
+    /**
+     * test that quote() escapes null byte character
+     * in a string.
+     */
+    public function testAdapterQuoteNullByteCharacter()
+    {
+        $string = "1\0";
+        $value  = $this->_db->quote($string);
+        $this->assertEquals("'1\\000'", $value);
+    }
 }