Changeset 729

Timestamp:

Jun 30, 2020 12:58:18 AM (4 years ago)

Author:

anonymous

Message:

 

Location:

trunk

Files:

• composer.json (modified) (1 diff)
• lib/PDO.inc.php (modified) (1 diff)
• lib/Utilities.inc.php (modified) (2 diffs)

trunk/composer.json

@@ -13 +13 @@
     ],
     "require": {
-        "php": ">=5.6 <7.4"
+        "php": ">=5.6 <=7.4"
     },
     "require-dev": {

trunk/lib/PDO.inc.php

@@ -184 +184 @@
 
         try {
+            // Set charset in DSN and disable emulated prepares as per https://stackoverflow.com/questions/134099/are-pdo-prepared-statements-sufficient-to-prevent-sql-injection/12202218
             $dsn = sprintf('mysql:host=%s;dbname=%s;charset=%s', $this->getParam('db_server'), $this->getParam('db_name'), $this->getParam('character_set'));
             $options = [

trunk/lib/Utilities.inc.php

@@ -404 +404 @@
     $num = mb_strlen($text);
     for ($i=0; $i<$num; $i++) {
-        $output .= sprintf('&#%03s', ord($text{$i}));
+        $output .= sprintf('&#%03s', ord($text[$i]));
     }
     return $output;
@@ -707 +707 @@
     $val = trim(ini_get($val));
     if ($val != '') {
-        $unit = strtolower($val{strlen($val) - 1});
+        $unit = strtolower($val[mb_strlen($val) - 1]);
         $val = preg_replace('/\D/', '', $val);