webapp/phpmyadmin
1
0
Fork 0
mirror of https://github.com/phpmyadmin/phpmyadmin.git synced 2026-10-28 07:41:55 +03:00
Code Activity

no ajax variable escaping

Browse Source
This commit is contained in:
Tyron Madlener
2011-06-19 12:28:18 +02:00
parent 91458b66fd
commit 4ee08ac03d
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
server_variables.php
View File

@@ -37,13 +37,13 @@ if (isset($_REQUEST['ajax_request']) && $_REQUEST['ajax_request'] == true) {
if(isset($_REQUEST['type'])) {
switch($_REQUEST['type']) {
case 'getval':
$varValue = PMA_DBI_fetch_single_row('SHOW GLOBAL VARIABLES WHERE Variable_name="'.mysql_real_escape_string($_REQUEST['varName']).'";','NUM');
$varValue = PMA_DBI_fetch_single_row('SHOW GLOBAL VARIABLES WHERE Variable_name="'.$_REQUEST['varName'].'";','NUM');
exit($varValue[1]);
break;
case 'setval':
if(PMA_DBI_query('SET GLOBAL '.mysql_real_escape_string($_REQUEST['varName']).' = \''.mysql_real_escape_string($_REQUEST['varValue']).'\''))
if(PMA_DBI_query('SET GLOBAL '.$_REQUEST['varName'].' = \''.$_REQUEST['varValue'].'\''))
// Some values are rounded down etc.
$varValue = PMA_DBI_fetch_single_row('SHOW GLOBAL VARIABLES WHERE Variable_name="'.mysql_real_escape_string($_REQUEST['varName']).'";','NUM');
$varValue = PMA_DBI_fetch_single_row('SHOW GLOBAL VARIABLES WHERE Variable_name="'.$_REQUEST['varName'].'";','NUM');
exit(json_encode(array(
'success' => true,