db_escape_string() should use for escape user query argument inputs. $ts['sql'] is column name, where $ts['sort'] are ASC or DESC. They shouldn't use db_escape_string().

CommentFileSizeAuthor
#2 incorrect_db_escape_string-0.2.patch776 byteshswong3i
incorrect_db_escape_string-0.1.patch775 byteshswong3i

Comments

hswong3i’s picture

hswong3i commented
Title: incorrect use of db_escape_string() » Siren #11: incorrect use of db_escape_string()
Assigned: Unassigned » hswong3i

I mark this into my personal research project issue.

hswong3i’s picture

hswong3i commented
StatusFileSize
new incorrect_db_escape_string-0.2.patch776 bytes

Patch reroll via latest CVS HEAD. Test without ill effect.

hswong3i’s picture

hswong3i commented
Priority: Normal » Critical

Just hope to promote if we are able to fix this within D6 RC1.

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Priority: Critical » Normal
Status: Needs review » Closed (duplicate)

This still needs to be sanitized. Feel free to merge with http://drupal.org/node/198856 as it is about %s, which is exactly a db_escape_string() just as with here, and even with column names as there.

hswong3i’s picture

hswong3i commented

merged