| @@ -79,45 +79,9 @@ | ||
| 79 | 79 | return false; |
| 80 | 80 | } |
| 81 | 81 | |
| 82 | 82 | // only select queries allowed. |
| 83 | - if ( ! preg_match( '/\s*(\bselect\b)\s/i', $this->_query ) ) { | |
| 84 | - $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' ); | |
| 85 | - return false; | |
| 86 | - } | |
| 87 | - | |
| 88 | - // if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries. | |
| 89 | - $disallow_query_parts = array( | |
| 90 | - 'INSERT', | |
| 91 | - 'UPDATE', | |
| 92 | - 'DELETE', | |
| 93 | - 'RENAME', | |
| 94 | - 'DROP', | |
| 95 | - 'CREATE', | |
| 96 | - 'TRUNCATE', | |
| 97 | - 'ALTER', | |
| 98 | - 'COMMIT', | |
| 99 | - 'ROLLBACK', | |
| 100 | - 'MERGE', | |
| 101 | - 'CALL', | |
| 102 | - 'EXPLAIN', | |
| 103 | - 'LOCK', | |
| 104 | - 'GRANT', | |
| 105 | - 'REVOKE', | |
| 106 | - 'SAVEPOINT', | |
| 107 | - 'TRANSACTION', | |
| 108 | - 'SET', | |
| 109 | - ); | |
| 110 | - $disallow_regex = implode( | |
| 111 | - '|', | |
| 112 | - array_map( | |
| 113 | - function ( $value ) { | |
| 114 | - return '\b' . $value . '\b'; | |
| 115 | - }, $disallow_query_parts | |
| 116 | - ) | |
| 117 | - ); | |
| 118 | - | |
| 119 | - if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) { | |
| 83 | + if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) { | |
| 120 | 84 | $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' ); |
| 121 | 85 | return false; |
| 122 | 86 | } |
| 123 | 87 | |
