Post containing %s in body does not save
Brought to you by:
omniti
Menu
▾
▴
#14 Post containing %s in body does not save
If you try to save a post with as %s, query parameters could get injected in the middle of your post when the query is being generated.
In SQL Server drive (sqlsrv.php), change the escape function to also escape percentages %:
function _real_escape( $string ) {
// there is no built in escape method for sql server
$s = str_replace("'", "''", $string);
$s = str_replace("%", "%%", $s); //
return $s;
}
My suggested solution is bad, it inserts double % symbols :(