modified MySQL and MySQLi drivers to address a potential SQL injection attack vector when multi-byte character set connections are employed. (Does not impact Latin-1, UTF-8, etc. encodings)
diff --git a/system/database/drivers/mysqli/mysqli_driver.php b/system/database/drivers/mysqli/mysqli_driver.php
index ccdabce..1949acb 100644
--- a/system/database/drivers/mysqli/mysqli_driver.php
+++ b/system/database/drivers/mysqli/mysqli_driver.php
@@ -132,7 +132,22 @@
*/
function _db_set_charset($charset, $collation)
{
- return @mysqli_query($this->conn_id, "SET NAMES '".$this->escape_str($charset)."' COLLATE '".$this->escape_str($collation)."'");
+ static $use_set_names;
+
+ if ( ! isset($use_set_names))
+ {
+ // mysqli_set_charset() requires MySQL >= 5.0.7, use SET NAMES as fallback
+ $use_set_names = (version_compare(mysql_get_server_info(), '5.0.7', '>=')) ? FALSE : TRUE;
+ }
+
+ if ($use_set_names)
+ {
+ return @mysqli_query($this->conn_id, "SET NAMES '".$this->escape_str($charset)."' COLLATE '".$this->escape_str($collation)."'");
+ }
+ else
+ {
+ return @mysqli_set_charset($this->conn_id, $charset);
+ }
}
// --------------------------------------------------------------------