| @@ -35,16 +35,8 @@ | ||
| 35 | 35 | */ |
| 36 | 36 | protected $_query; |
| 37 | 37 | |
| 38 | 38 | /** |
| 39 | - * The error message. | |
| 40 | - * | |
| 41 | - * @access protected | |
| 42 | - * @var string | |
| 43 | - */ | |
| 44 | - protected $_error; | |
| 45 | - | |
| 46 | - /** | |
| 47 | 39 | * Constructor. |
| 48 | 40 | * |
| 49 | 41 | * @access public |
| 50 | 42 | * @param string $query The query. |
| @@ -66,8 +58,14 @@ | ||
| 66 | 58 | if ( empty( $this->_query ) ) { |
| 67 | 59 | return false; |
| 68 | 60 | } |
| 69 | 61 | |
| 62 | + // only select queries allowed. | |
| 63 | + if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) { | |
| 64 | + $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' ); | |
| 65 | + return false; | |
| 66 | + } | |
| 67 | + | |
| 70 | 68 | // impose a limit if no limit clause is provided. |
| 71 | 69 | if ( strpos( strtolower( $this->_query ), ' limit ' ) === false ) { |
| 72 | 70 | $this->_query .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000 ); |
| 73 | 71 | } |
| @@ -175,18 +173,8 @@ | ||
| 175 | 173 | } |
| 176 | 174 | $this->_data = $data; |
| 177 | 175 | |
| 178 | 176 | return true; |
| 179 | - } | |
| 180 | - | |
| 181 | - /** | |
| 182 | - * Returns the error, if any. | |
| 183 | - * | |
| 184 | - * @access public | |
| 185 | - * @return string | |
| 186 | - */ | |
| 187 | - public function get_error() { | |
| 188 | - return $this->_error; | |
| 189 | 177 | } |
| 190 | 178 | |
| 191 | 179 | /** |
| 192 | 180 | * Returns the final query. |
