diff options
Diffstat (limited to 'phpBB/includes')
| -rw-r--r-- | phpBB/includes/db/firebird.php | 2 | ||||
| -rw-r--r-- | phpBB/includes/db/mssql.php | 2 | ||||
| -rw-r--r-- | phpBB/includes/db/mssql_odbc.php | 2 | ||||
| -rw-r--r-- | phpBB/includes/db/oracle.php | 2 | ||||
| -rw-r--r-- | phpBB/includes/functions.php | 2 |
5 files changed, 5 insertions, 5 deletions
diff --git a/phpBB/includes/db/firebird.php b/phpBB/includes/db/firebird.php index 0157238fcd..3b31942a8b 100644 --- a/phpBB/includes/db/firebird.php +++ b/phpBB/includes/db/firebird.php @@ -425,7 +425,7 @@ class dbal_firebird extends dbal */ function sql_escape($msg) { - return str_replace("'", "''", $msg); + return str_replace(array("'", "\0"), array("''", ''), $msg); } /** diff --git a/phpBB/includes/db/mssql.php b/phpBB/includes/db/mssql.php index 4131be2c32..7134574691 100644 --- a/phpBB/includes/db/mssql.php +++ b/phpBB/includes/db/mssql.php @@ -328,7 +328,7 @@ class dbal_mssql extends dbal */ function sql_escape($msg) { - return str_replace("'", "''", $msg); + return str_replace(array("'", "\0"), array("''", ''), $msg); } /** diff --git a/phpBB/includes/db/mssql_odbc.php b/phpBB/includes/db/mssql_odbc.php index a29af45c8f..14c4831010 100644 --- a/phpBB/includes/db/mssql_odbc.php +++ b/phpBB/includes/db/mssql_odbc.php @@ -349,7 +349,7 @@ class dbal_mssql_odbc extends dbal */ function sql_escape($msg) { - return str_replace("'", "''", $msg); + return str_replace(array("'", "\0"), array("''", ''), $msg); } /** diff --git a/phpBB/includes/db/oracle.php b/phpBB/includes/db/oracle.php index 0daddf76cb..8fdb29ce5b 100644 --- a/phpBB/includes/db/oracle.php +++ b/phpBB/includes/db/oracle.php @@ -551,7 +551,7 @@ class dbal_oracle extends dbal */ function sql_escape($msg) { - return str_replace("'", "''", $msg); + return str_replace(array("'", "\0"), array("''", ''), $msg); } /** diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php index 0c5daa9231..862314aba9 100644 --- a/phpBB/includes/functions.php +++ b/phpBB/includes/functions.php @@ -32,7 +32,7 @@ function set_var(&$result, $var, $type, $multibyte = false) if ($type == 'string') { - $result = trim(htmlspecialchars(str_replace(array("\r\n", "\r"), array("\n", "\n"), $result), ENT_COMPAT, 'UTF-8')); + $result = trim(htmlspecialchars(str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result), ENT_COMPAT, 'UTF-8')); if (!empty($result)) { |