columnList() properly escapes table names

2014-06-16 22:40:22 +00:00
parent 1d797b306e
commit eb36858f1a
3 changed files with 12 additions and 8 deletions
--- a/db.class.php
+++ b/db.class.php
@@ -385,7 +385,7 @@ class MeekroDB {
  }
  
  public function columnList($table) {
-    return $this->queryOneColumn('Field', "SHOW COLUMNS FROM $table");
+    return $this->queryOneColumn('Field', "SHOW COLUMNS FROM %b", $table);
  }
  
  public function tableList($db = null) {