Escape identifier

git-svn-id: https://adminer.svn.sourceforge.net/svnroot/adminer/trunk@748 7c3ca157-0c34-0410-bff1-cbf682f78f5c

diff --git a/adminer/create.inc.php b/adminer/create.inc.php
index 0abd497de9fc73a8c7ba0838c0c3bac489c25ae1..7a469bfce2843bc766af9fb943fc01e8668987cf 100644 (file)
--- a/adminer/create.inc.php
+++ b/adminer/create.inc.php
@@ -52,10 +52,10 @@ if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"]
                        if ($_POST["partition_by"] == 'RANGE' || $_POST["partition_by"] == 'LIST') {
                                foreach (array_filter($_POST["partition_names"]) as $key => $val) {
                                        $value = $_POST["partition_values"][$key];
-                                       $partitions[] = "\nPARTITION $val VALUES " . ($_POST["partition_by"] == 'RANGE' ? "LESS THAN" : "IN") . (strlen($value) ? " ($value)" : " MAXVALUE"); //! SQL injection
+                                       $partitions[] = "\nPARTITION " . idf_escape($val) . " VALUES " . ($_POST["partition_by"] == 'RANGE' ? "LESS THAN" : "IN") . (strlen($value) ? " ($value)" : " MAXVALUE"); //! SQL injection
                                }
                        }
-                       $status .= "\nPARTITION BY $_POST[partition_by]($_POST[partition])" . ($partitions ? " (" . implode(",", $partitions) . "\n)" : ($_POST["partitions"] ? " PARTITIONS " . intval($_POST["partitions"]) : ""));
+                       $status .= "\nPARTITION BY $_POST[partition_by]($_POST[partition])" . ($partitions ? " (" . implode(",", $partitions) . "\n)" : ($_POST["partitions"] ? " PARTITIONS " . intval($_POST["partitions"]) : "")); // $_POST["partition"] can be expression, not only column
                } elseif ($dbh->server_info >= 5.1 && strlen($_GET["create"])) {
                        $status .= "\nREMOVE PARTITIONING";
                }