Check collation

diff --git a/adminer/database.inc.php b/adminer/database.inc.php
index eb9f6ac37db7eba9d9c543cc0ae47286d7639aec..946152890e3e3a88c090b0b2f09a10b2eda7206a 100644 (file)
--- a/adminer/database.inc.php
+++ b/adminer/database.inc.php
@@ -28,7 +28,7 @@ if ($_POST && !$error && !isset($_POST["add_x"])) { // add is an image and PHP c
                if (!$_POST["collation"]) {
                        redirect(substr(ME, 0, -1));
                }
-               query_redirect("ALTER DATABASE " . idf_escape($_POST["name"]) . " COLLATE $_POST[collation]", substr(ME, 0, -1), lang('Database has been altered.')); //! SQL injection - quotes are not allowed in MS SQL 2005
+               query_redirect("ALTER DATABASE " . idf_escape($_POST["name"]) . (eregi('^[a-z0-9_]+$', $_POST["collation"]) ? " COLLATE $_POST[collation]" : ""), substr(ME, 0, -1), lang('Database has been altered.')); //! SQL injection - quotes are not allowed in MS SQL 2005
        }
 }
 

diff --git a/adminer/drivers/mssql.inc.php b/adminer/drivers/mssql.inc.php
index 5d850a36e60559ad0d1afa4133906d922811d698..de3114bd73f1f9642a84316ec7df68ffe80d3b71 100644 (file)
--- a/adminer/drivers/mssql.inc.php
+++ b/adminer/drivers/mssql.inc.php
@@ -383,7 +383,7 @@ WHERE OBJECT_NAME(i.object_id) = " . q($table)
        }
 
        function create_database($db, $collation) {
-               return queries("CREATE DATABASE " . idf_escape($db) . ($collation ? " COLLATE $collation" : ""));
+               return queries("CREATE DATABASE " . idf_escape($db) . (eregi('^[a-z0-9_]+$', $collation) ? " COLLATE $collation" : ""));
        }
        
        function drop_databases($databases) {
@@ -391,7 +391,7 @@ WHERE OBJECT_NAME(i.object_id) = " . q($table)
        }
        
        function rename_database($name, $collation) {
-               if ($collation) {
+               if (eregi('^[a-z0-9_]+$', $collation)) {
                        queries("ALTER DATABASE " . idf_escape(DB) . " COLLATE $collation");
                }
                queries("ALTER DATABASE " . idf_escape(DB) . " MODIFY NAME = " . idf_escape($name));