From 2c1d80c75a3f41517090004e59f1e04a21437cc8 Mon Sep 17 00:00:00 2001
From: Meik Sievertsen <acydburn@phpbb.com>
Date: Thu, 2 Oct 2008 12:04:12 +0000
Subject: Remove NUL-Bytes directly in request_var() for strings and within the
 custom DBAL sql_escape() functions (MSSQL, Firebird, Oracle) (reported by
 AdhostMikeSw)

git-svn-id: file:///svn/phpbb/branches/phpBB-3_0_0@8967 89ea8834-ac86-4346-8a33-228a782c2dd0
---
 phpBB/includes/db/oracle.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'phpBB/includes/db/oracle.php')

diff --git a/phpBB/includes/db/oracle.php b/phpBB/includes/db/oracle.php
index 0daddf76cb..8fdb29ce5b 100644
--- a/phpBB/includes/db/oracle.php
+++ b/phpBB/includes/db/oracle.php
@@ -551,7 +551,7 @@ class dbal_oracle extends dbal
 	*/
 	function sql_escape($msg)
 	{
-		return str_replace("'", "''", $msg);
+		return str_replace(array("'", "\0"), array("''", ''), $msg);
 	}
 
 	/**
-- 
cgit v1.2.1