Skip to content

Commit 5e34d59

Browse files
committed
Escape dollar signs in named parameters because they donot survive preg_replace but are needed for passwords.
1 parent d4f95b1 commit 5e34d59

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

system/Database/Query.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -404,11 +404,16 @@ protected function matchNamedBinds(string $sql, array $binds)
404404
foreach ($binds as $placeholder => $value)
405405
{
406406
$escapedValue = $this->db->escape($value);
407+
407408
if (is_array($escapedValue))
408409
{
409410
$escapedValue = '('.implode(',', $escapedValue).')';
410411
}
411412

413+
// $ causes issues in preg_replace, but are needed
414+
// for password hashes
415+
$escapedValue = str_replace('$', '\$', $escapedValue);
416+
412417
$sql = preg_replace('/:'.$placeholder.'(?!\w)/', $escapedValue, $sql);
413418
}
414419

0 commit comments

Comments
 (0)