Browse Source

Add Database::escape_string

jmontoyaa 7 years ago
parent
commit
07337e2f7e
1 changed files with 1 additions and 0 deletions
  1. 1 0
      main/inc/lib/fileDisplay.lib.php

+ 1 - 0
main/inc/lib/fileDisplay.lib.php

@@ -283,6 +283,7 @@ function get_total_folder_size($path, $can_see_invisible = false)
         'props.session_id'
     );
 
+    $path = Database::escape_string($path);
     $visibility_rule = ' props.visibility '.($can_see_invisible ? '<> 2' : '= 1');
 
     $sql = "SELECT SUM(table1.size) FROM (