Kit::ValidateParam fails on passwords containing ampersands

[Micah Tomblin]

It appears that we're currently running htmlentities() on _PASSWORD types in Kit::ValidateParam(), which causes passwords containing ampersands to change from something like this: "p&ssword" to something like this: "p&ssword". This can cause the initial database-creation steps of the install to fail.

[Alex Harrington (alexharrington)]

Perhaps need to move to just using sprintf combined with mysql_real_escape_string(). eg: http://www.bitrepository.com/sanitize-data-to-prevent-sql-injection-attacks.html

Presumably $db->escape_string() is equivalent to mysql_real_escape_string() so perhaps all that's required is dropping the htmlentities() command?

I've taken a quick look through the installer/upgrader code and I don't think it would care if that happened.

A

[Dan Garner (dangarner)]

All strings are sprintf & mysql_real_escape_string before making it into any
SQL - so that wouldn't be necessary.

Perhaps we just drop the html entities?

[Alex Harrington (alexharrington)]

Sounds sensible. I'll target.