Add Database::escape_string

7 years ago · 07337e2f7e
parent 4673586d6b
commit 07337e2f7e
1 changed files with 1 additions and 0 deletions
--- a/main/inc/lib/fileDisplay.lib.php
+++ b/main/inc/lib/fileDisplay.lib.php
@ -283,6 +283,7 @@ function get_total_folder_size($path, $can_see_invisible = false)
        'props.session_id'
    );

+    $path = Database::escape_string($path);
    $visibility_rule = ' props.visibility '.($can_see_invisible ? '<> 2' : '= 1');

    $sql = "SELECT SUM(table1.size) FROM (