Bug #9995

DB_mysql::tableInfo() should quote identifier for table name

Details

Submitted	2007-02-01 01:30 UTC
From	lakiboy83 at gmail dot com
Status	Wont fix
Package	DB
PHP Version	5.2.0
OS	WinXp
Roadmaps	(Not assigned)

Comments

[2007-02-01 01:30 UTC] lakiboy83 at gmail dot com

Description:
------------
DB_mysql::tableInfo() does not quote identifier i.e. table name specified as first argument. Queries with table names like 'content-category' will fail.

I suggest replacing
$id = @mysql_query("SELECT * FROM $result LIMIT 0",
$this->connection);
with
$id = @mysql_query("SELECT * FROM " . $this->quoteIdentifier($result) . " LIMIT 0",
$this->connection);

[2007-02-01 11:39 UTC] lakiboy83 at gmail dot com

It is already broken. The application i use started to give an error using this feature, right after i updated PEAR::DB.

[2007-02-01 13:19 UTC] lakiboy83 at gmail dot com

Ok. Don't want to be annoying, but if the problem is in dbname.table below is another suggestion:

/*
* Check if dbname.tablename is recieved.
*/
if (strpos($result, '.') !== false) {
$aResult = explode('.', $result);
/*
* If yes, quote both
*/
$result = $this->quoteIdentifier($aResult[0]) . '.' .
$this->quoteIdentifier($aResult[1]);
}

/*
* Probably received a table name.
* Create a result resource identifier.
*/
$id = @mysql_query("SELECT * FROM " . $result . " LIMIT 0",
$this->connection);