SQL injection when selecting password for the first time.

[Adrian Harabulă]

When i'm installing mysql-server with apt-get install mysql-server , everything is OK until i get a blue screen when I have to set my password.

If i put a password with " then I get this on terminal:

 * Stopping MySQL database server mysqld [ OK ]
ERROR: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ziah0") WHERE user='root'' at line 1
080822 14:59:05 [ERROR] Aborting

080822 14:59:05 [Note] /usr/sbin/mysqld: Shutdown complete

Reloading AppArmor profiles : done.
 * Starting MySQL database server mysqld [ OK ]
 * Checking for corrupt, not cleanly closed and upgrade needing tables.

Thanks.

[Marc Deslauriers (mdeslaur)]

This is confirmed in jaunty. Setting as low importance, as you're already root when this happens.

[bdeetz (bdeetz)]

@Marc I understand that the fact that it's a point for SQL injection isn't too much of an issue since we're already root at this point, but the fact that it fails to set one's password is less than desirable. Sure, I can go set my password in the console after the setup is complete, but why should the installer even prompt me to setup a password if I can't use a decent password?

I've been witnessing this bug for years and I'm surprised there aren't more people discussing it. As such, I'm willing to take it on. This should just be a matter of character escaping. Here's to hoping I have a patch in a little while.

[Marc Deslauriers (mdeslaur)]

Great! Please subscribe ubuntu-sponsors once you attach a patch and someone will process it. Thanks!