Changeset 13853

Timestamp:

03/28/2010 01:57:45 AM (15 years ago)

Author:

dd32

Message:

Validate Table Prefix in wp-config.php generator. Props johnl1479. Fixes #12622

File:

• trunk/wp-admin/setup-config.php (modified) (1 diff)

trunk/wp-admin/setup-config.php

@@ -158 +158 @@
     $dbhost  = trim($_POST['dbhost']);
     $prefix  = trim($_POST['prefix']);
-    if (empty($prefix)) $prefix = 'wp_';
+    if ( empty($prefix) )
+        $prefix = 'wp_';
+
+    // Validate $prefix: it can only contain letters, numbers and underscores 
+    if ( preg_match( '|[^a-z0-9_]|i', $prefix ) ) 
+        wp_die( /*WP_I18N_BAD_PREFIX*/'<strong>ERROR</strong>: "Table Prefix" can only contain numbers, letters, and underscores.'/*/WP_I18N_BAD_PREFIX*/ ); 
 
     // Test the db connection.