search

scan5415 / grav-plugin-form-database

MIT License
15 stars 10 forks source link

Escape quotes in text fields #2

Open wizidot opened 7 years ago

wizidot commented 7 years ago

Hi i've encountered an error when i trying to save text values with specials chars like quotes. It seems that values are not cleaned before insert. I purpose to use addslashes in the plugin like this : 


                        $fieldnames = "(" . $field ."";
                        //Check if it an number value, if yes don't put in ''
                        if(in_array($fieldType,array('smallint','tinyint','mediumint','int','bigint','decimal','float','double','read','bit','boolean','serial'),true)) {
                            $fieldvalues = "(" . $_POST['data'][$val];
                        } else {
                            $fieldvalues = "('" . addslashes($_POST['data'][$val]) ."'";
                        }

                    } else {

                        $fieldnames .= "," . $field . "";
                        //Check if it an number value, if yes don't put in ''
                        if(in_array($fieldType,array('smallint','tinyint','mediumint','int','bigint','decimal','float','double','read','bit','boolean','serial'),true)) {
                            $fieldvalues .= "," . $_POST['data'][$val];
                        } else {
                            $fieldvalues .= ",'" . addslashes($_POST['data'][$val]) ."'";
                        }
                    }```