Commit 32b81aa1 authored by Alexander Butenko's avatar Alexander Butenko

Allow backticks in order by

parent 6407b01c
......@@ -469,14 +469,14 @@ class MysqliDb
{
$allowedDirection = Array ("ASC", "DESC");
$orderbyDirection = strtoupper (trim ($orderbyDirection));
$orderByField = preg_replace ("/[^-a-z0-9\.\(\),_]+/i",'', $orderByField);
$orderByField = preg_replace ("/[^-a-z0-9\.\(\),_`]+/i",'', $orderByField);
if (empty($orderbyDirection) || !in_array ($orderbyDirection, $allowedDirection))
die ('Wrong order direction: '.$orderbyDirection);
if (is_array ($customFields)) {
foreach ($customFields as $key => $value)
$customFields[$key] = preg_replace ("/[^-a-z0-9\.\(\),_]+/i",'', $value);
$customFields[$key] = preg_replace ("/[^-a-z0-9\.\(\),_`]+/i",'', $value);
$orderByField = 'FIELD (' . $orderByField . ', "' . implode('","', $customFields) . '")';
}
......
......@@ -157,12 +157,13 @@ $q = "drop table {$prefix}test;";
$db->rawQuery($q);
$db->orderBy("id","asc");
$db->orderBy("`id`","asc");
$users = $db->get("users");
if ($db->count != 3) {
echo "Invalid total insert count";
exit;
}
echo $db->getLastQuery();
// order by field
$db->orderBy("login","asc", Array ("user3","user2","user1"));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment