Quote the identifiers in the back end filter menu (see #906)

Description ----------- Fixes #847 Commits ------- 24928cb3 Quote the identifiers in the back end filter menu (see #847)
contao · Oct 31, 2019 · 473a0a1 · 473a0a1
1 parent 27b77a4
commit 473a0a1
Showing 1 changed file with 10 additions and 8 deletions.
diff --git a/src/Resources/contao/drivers/DC_Table.php b/src/Resources/contao/drivers/DC_Table.php
@@ -5471,19 +5471,21 @@ protected function filterMenu($intFilterPanel)
 		{
 			foreach ($sortingFields as $field)
 			{
+				$what = Database::quoteIdentifier($field);
+
 				if (isset($session['filter'][$filter][$field]))
 				{
 					// Sort by day
 					if (\in_array($GLOBALS['TL_DCA'][$this->strTable]['fields'][$field]['flag'], array(5, 6)))
 					{
 						if ($session['filter'][$filter][$field] == '')
 						{
-							$this->procedure[] = $field . "=''";
+							$this->procedure[] = $what . "=''";
 						}
 						else
 						{
 							$objDate = new \Date($session['filter'][$filter][$field]);
-							$this->procedure[] = $field . ' BETWEEN ? AND ?';
+							$this->procedure[] = $what . ' BETWEEN ? AND ?';
 							$this->values[] = $objDate->dayBegin;
 							$this->values[] = $objDate->dayEnd;
 						}
@@ -5494,12 +5496,12 @@ protected function filterMenu($intFilterPanel)
 					{
 						if ($session['filter'][$filter][$field] == '')
 						{
-							$this->procedure[] = $field . "=''";
+							$this->procedure[] = $what . "=''";
 						}
 						else
 						{
 							$objDate = new \Date($session['filter'][$filter][$field]);
-							$this->procedure[] = $field . ' BETWEEN ? AND ?';
+							$this->procedure[] = $what . ' BETWEEN ? AND ?';
 							$this->values[] = $objDate->monthBegin;
 							$this->values[] = $objDate->monthEnd;
 						}
@@ -5510,12 +5512,12 @@ protected function filterMenu($intFilterPanel)
 					{
 						if ($session['filter'][$filter][$field] == '')
 						{
-							$this->procedure[] = $field . "=''";
+							$this->procedure[] = $what . "=''";
 						}
 						else
 						{
 							$objDate = new \Date($session['filter'][$filter][$field]);
-							$this->procedure[] = $field . ' BETWEEN ? AND ?';
+							$this->procedure[] = $what . ' BETWEEN ? AND ?';
 							$this->values[] = $objDate->yearBegin;
 							$this->values[] = $objDate->yearEnd;
 						}
@@ -5532,15 +5534,15 @@ protected function filterMenu($intFilterPanel)
 						}
 						else
 						{
-							$this->procedure[] = $field . ' LIKE ?';
+							$this->procedure[] = $what . ' LIKE ?';
 							$this->values[] = '%"' . $session['filter'][$filter][$field] . '"%';
 						}
 					}
 
 					// Other sort algorithm
 					else
 					{
-						$this->procedure[] = $field . '=?';
+						$this->procedure[] = $what . '=?';
 						$this->values[] = $session['filter'][$filter][$field];
 					}
 				}