Fixed bug #62978. pg_select()/etc may allow SQL injection when table name is user parameter, users are able to control table names.

14 files changed, 34 insertions, 34 deletions

diff --git a/ext/pgsql/tests/10pg_convert.phpt b/ext/pgsql/tests/10pg_convert.phpt
index fde4c67d37..adc2756e25 100644
--- a/ext/pgsql/tests/10pg_convert.phpt
+++ b/ext/pgsql/tests/10pg_convert.phpt
@@ -20,10 +20,10 @@ var_dump($converted);
 ?>
 --EXPECT--
 array(3) {
-  ["num"]=>
+  [""num""]=>
   string(4) "1234"
-  ["str"]=>
-  string(5) "'AAA'"
-  ["bin"]=>
-  string(5) "'BBB'"
-}
+  [""str""]=>
+  string(6) "E'AAA'"
+  [""bin""]=>
+  string(6) "E'BBB'"
+}
\ No newline at end of file
diff --git a/ext/pgsql/tests/10pg_convert_9.phpt b/ext/pgsql/tests/10pg_convert_9.phpt
index bb2e7e6d2a..827c96250d 100644
--- a/ext/pgsql/tests/10pg_convert_9.phpt
+++ b/ext/pgsql/tests/10pg_convert_9.phpt
@@ -21,10 +21,10 @@ var_dump($converted);
 ?>
 --EXPECT--
 array(3) {
-  ["num"]=>
+  [""num""]=>
   string(4) "1234"
-  ["str"]=>
-  string(5) "'AAA'"
-  ["bin"]=>
-  string(11) "'\\x424242'"
-}
+  [""str""]=>
+  string(6) "E'AAA'"
+  [""bin""]=>
+  string(12) "E'\\x424242'"
+}
\ No newline at end of file
diff --git a/ext/pgsql/tests/12pg_insert.phpt b/ext/pgsql/tests/12pg_insert.phpt
index 66304944b0..9fd0dd1e3b 100644
--- a/ext/pgsql/tests/12pg_insert.phpt
+++ b/ext/pgsql/tests/12pg_insert.phpt
@@ -20,5 +20,5 @@ echo pg_insert($db, $table_name, $fields, PGSQL_DML_STRING)."\n";
 echo "Ok\n";
 ?>
 --EXPECT--
-INSERT INTO php_pgsql_test (num,str,bin) VALUES (1234,'AAA','BBB');
-Ok
+INSERT INTO "php_pgsql_test" ("num","str","bin") VALUES (1234,E'AAA',E'BBB');
+Ok
\ No newline at end of file
diff --git a/ext/pgsql/tests/12pg_insert_9.phpt b/ext/pgsql/tests/12pg_insert_9.phpt
index 8afae0df91..329364ad64 100644
--- a/ext/pgsql/tests/12pg_insert_9.phpt
+++ b/ext/pgsql/tests/12pg_insert_9.phpt
@@ -22,5 +22,5 @@ echo pg_insert($db, $table_name, $fields, PGSQL_DML_STRING)."\n";
 echo "Ok\n";
 ?>
 --EXPECT--
-INSERT INTO php_pgsql_test (num,str,bin) VALUES (1234,'AAA','\\x424242');
-Ok
+INSERT INTO "php_pgsql_test" ("num","str","bin") VALUES (1234,E'AAA',E'\\x424242');
+Ok
\ No newline at end of file
diff --git a/ext/pgsql/tests/13pg_select.phpt b/ext/pgsql/tests/13pg_select.phpt
index f1504a8b17..db2ca06bf8 100644
--- a/ext/pgsql/tests/13pg_select.phpt
+++ b/ext/pgsql/tests/13pg_select.phpt
@@ -33,5 +33,5 @@ array(1) {
     string(3) "BBB"
   }
 }
-SELECT * FROM php_pgsql_test WHERE num=1234;
+SELECT * FROM "php_pgsql_test" WHERE "num"=1234;
 Ok
diff --git a/ext/pgsql/tests/13pg_select_9.phpt b/ext/pgsql/tests/13pg_select_9.phpt
index 422c461b60..67adc9d21d 100644
--- a/ext/pgsql/tests/13pg_select_9.phpt
+++ b/ext/pgsql/tests/13pg_select_9.phpt
@@ -35,5 +35,5 @@ array(1) {
     string(8) "\x424242"
   }
 }
-SELECT * FROM php_pgsql_test WHERE num=1234;
-Ok
+SELECT * FROM "php_pgsql_test" WHERE "num"=1234;
+Ok
\ No newline at end of file
diff --git a/ext/pgsql/tests/14pg_update.phpt b/ext/pgsql/tests/14pg_update.phpt
index 3260f2b73e..347cac9447 100644
--- a/ext/pgsql/tests/14pg_update.phpt
+++ b/ext/pgsql/tests/14pg_update.phpt
@@ -21,5 +21,5 @@ echo pg_update($db, $table_name, $fields, $ids, PGSQL_DML_STRING)."\n";
 echo "Ok\n";
 ?>
 --EXPECT--
-UPDATE php_pgsql_test SET num=1234,str='ABC',bin='XYZ' WHERE num=1234;
-Ok
+UPDATE "php_pgsql_test" SET "num"=1234,"str"=E'ABC',"bin"=E'XYZ' WHERE "num"=1234;
+Ok
\ No newline at end of file
diff --git a/ext/pgsql/tests/14pg_update_9.phpt b/ext/pgsql/tests/14pg_update_9.phpt
index bc5cf673e3..e766c1f380 100644
--- a/ext/pgsql/tests/14pg_update_9.phpt
+++ b/ext/pgsql/tests/14pg_update_9.phpt
@@ -23,5 +23,5 @@ echo pg_update($db, $table_name, $fields, $ids, PGSQL_DML_STRING)."\n";
 echo "Ok\n";
 ?>
 --EXPECT--
-UPDATE php_pgsql_test SET num=1234,str='ABC',bin='\\x58595a' WHERE num=1234;
-Ok
+UPDATE "php_pgsql_test" SET "num"=1234,"str"=E'ABC',"bin"=E'\\x58595a' WHERE "num"=1234;
+Ok
\ No newline at end of file
diff --git a/ext/pgsql/tests/bug47199.phpt b/ext/pgsql/tests/bug47199.phpt
index 5bfac0b1bb..faa787fd54 100644
--- a/ext/pgsql/tests/bug47199.phpt
+++ b/ext/pgsql/tests/bug47199.phpt
@@ -52,8 +52,8 @@ array(2) {
     string(1) "2"
   }
 }
-DELETE FROM test_47199 WHERE null_field IS NULL AND not_null_field=2;
-UPDATE test_47199 SET null_field=NULL,not_null_field=0 WHERE not_null_field=1 AND null_field IS NULL;
+DELETE FROM "test_47199" WHERE "null_field" IS NULL AND "not_null_field"=2;
+UPDATE "test_47199" SET "null_field"=NULL,"not_null_field"=0 WHERE "not_null_field"=1 AND "null_field" IS NULL;
 array(1) {
   [0]=>
   array(2) {
diff --git a/ext/pgsql/tests/bug64609.phpt b/ext/pgsql/tests/bug64609.phpt
index 0df63012da..72fac7648e 100644
--- a/ext/pgsql/tests/bug64609.phpt
+++ b/ext/pgsql/tests/bug64609.phpt
@@ -25,6 +25,6 @@ var_dump($converted);
 ?>
 --EXPECT--
 array(1) {
-  ["a"]=>
-  string(4) "'ok'"
-}
+  [""a""]=>
+  string(5) "E'ok'"
+}
\ No newline at end of file
diff --git a/ext/pgsql/tests/config.inc b/ext/pgsql/tests/config.inc
index 2b5f05a71d..d4bbb33824 100644
--- a/ext/pgsql/tests/config.inc
+++ b/ext/pgsql/tests/config.inc
@@ -2,7 +2,7 @@
 // These vars are used to connect db and create test table.
 // values can be set to meet your environment
 
-$conn_str = "host=localhost dbname=test";    // connection string
+$conn_str = "host=localhost dbname=test port=5432";    // connection string
 $table_name = "php_pgsql_test";  // test table that should be exist
 $num_test_record = 1000;         // Number of records to create
 
diff --git a/ext/pgsql/tests/pg_delete_001.phpt b/ext/pgsql/tests/pg_delete_001.phpt
index abb65be142..a98c95dc4c 100644
--- a/ext/pgsql/tests/pg_delete_001.phpt
+++ b/ext/pgsql/tests/pg_delete_001.phpt
@@ -45,8 +45,8 @@ pg_query('DROP SCHEMA phptests');
 
 ?>
 --EXPECTF--
-string(37) "DELETE FROM foo WHERE id=1 AND id2=2;"
-string(46) "DELETE FROM phptests.foo WHERE id=2 AND id2=3;"
+string(43) "DELETE FROM "foo" WHERE "id"=1 AND "id2"=2;"
+string(54) "DELETE FROM "phptests"."foo" WHERE "id"=2 AND "id2"=3;"
 array(2) {
   [0]=>
   array(2) {
diff --git a/ext/pgsql/tests/pg_insert_001.phpt b/ext/pgsql/tests/pg_insert_001.phpt
index 7d27219187..626d4d0f82 100644
--- a/ext/pgsql/tests/pg_insert_001.phpt
+++ b/ext/pgsql/tests/pg_insert_001.phpt
@@ -28,7 +28,7 @@ pg_query('DROP SCHEMA phptests');
 --EXPECTF--
 
 Warning: pg_insert(): Table 'foo' doesn't exists in %s on line %d
-string(47) "INSERT INTO phptests.foo (id,id2) VALUES (1,2);"
+string(55) "INSERT INTO "phptests"."foo" ("id","id2") VALUES (1,2);"
 array(1) {
   [0]=>
   array(2) {
diff --git a/ext/pgsql/tests/pg_update_001.phpt b/ext/pgsql/tests/pg_update_001.phpt
index 95fa692568..60db35c157 100644
--- a/ext/pgsql/tests/pg_update_001.phpt
+++ b/ext/pgsql/tests/pg_update_001.phpt
@@ -35,8 +35,8 @@ pg_query('DROP SCHEMA phptests');
 
 ?>
 --EXPECT--
-string(32) "UPDATE foo SET id=10 WHERE id=1;"
-string(43) "UPDATE phptests.foo SET id=100 WHERE id2=2;"
+string(38) "UPDATE "foo" SET "id"=10 WHERE "id"=1;"
+string(51) "UPDATE "phptests"."foo" SET "id"=100 WHERE "id2"=2;"
 array(2) {
   ["id"]=>
   string(2) "10"