From cb640c87c1106d3e36f5012281fd4e7285fc5048 Mon Sep 17 00:00:00 2001
From: David Goodwin <david@palepurple.co.uk>
Date: Tue, 10 Jan 2012 23:03:38 +0000
Subject: [PATCH] fix sql injection in pacrypt() when mysql_crypt is in use;
 see previous commits etc esp in the 2.3 branch

git-svn-id: https://svn.code.sf.net/p/postfixadmin/code/trunk@1327 a1433add-5e2c-0410-b055-b7f2511e0802
---
 functions.inc.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/functions.inc.php b/functions.inc.php
index 5e7fe939..12e179d3 100644
--- a/functions.inc.php
+++ b/functions.inc.php
@@ -1099,6 +1099,7 @@ function pacrypt ($pw, $pw_db="") {
     // See https://sourceforge.net/tracker/?func=detail&atid=937966&aid=1793352&group_id=191583
     // this is apparently useful for pam_mysql etc.
     elseif ($CONF['encrypt'] == 'mysql_encrypt') {
+        $pw = escape_string($pw);
         if ($pw_db!="") {
             $salt=substr($pw_db,0,2);
             $res=db_query("SELECT ENCRYPT('".$pw."','".$salt."');");