Commit 32b81aa1 authored by Alexander Butenko's avatar Alexander Butenko

Allow backticks in order by

parent 6407b01c
...@@ -469,14 +469,14 @@ class MysqliDb ...@@ -469,14 +469,14 @@ class MysqliDb
{ {
$allowedDirection = Array ("ASC", "DESC"); $allowedDirection = Array ("ASC", "DESC");
$orderbyDirection = strtoupper (trim ($orderbyDirection)); $orderbyDirection = strtoupper (trim ($orderbyDirection));
$orderByField = preg_replace ("/[^-a-z0-9\.\(\),_]+/i",'', $orderByField); $orderByField = preg_replace ("/[^-a-z0-9\.\(\),_`]+/i",'', $orderByField);
if (empty($orderbyDirection) || !in_array ($orderbyDirection, $allowedDirection)) if (empty($orderbyDirection) || !in_array ($orderbyDirection, $allowedDirection))
die ('Wrong order direction: '.$orderbyDirection); die ('Wrong order direction: '.$orderbyDirection);
if (is_array ($customFields)) { if (is_array ($customFields)) {
foreach ($customFields as $key => $value) foreach ($customFields as $key => $value)
$customFields[$key] = preg_replace ("/[^-a-z0-9\.\(\),_]+/i",'', $value); $customFields[$key] = preg_replace ("/[^-a-z0-9\.\(\),_`]+/i",'', $value);
$orderByField = 'FIELD (' . $orderByField . ', "' . implode('","', $customFields) . '")'; $orderByField = 'FIELD (' . $orderByField . ', "' . implode('","', $customFields) . '")';
} }
......
...@@ -157,12 +157,13 @@ $q = "drop table {$prefix}test;"; ...@@ -157,12 +157,13 @@ $q = "drop table {$prefix}test;";
$db->rawQuery($q); $db->rawQuery($q);
$db->orderBy("id","asc"); $db->orderBy("`id`","asc");
$users = $db->get("users"); $users = $db->get("users");
if ($db->count != 3) { if ($db->count != 3) {
echo "Invalid total insert count"; echo "Invalid total insert count";
exit; exit;
} }
echo $db->getLastQuery();
// order by field // order by field
$db->orderBy("login","asc", Array ("user3","user2","user1")); $db->orderBy("login","asc", Array ("user3","user2","user1"));
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment