Add Mysql escaping

2 files changed, 6 insertions, 2 deletions

diff --git a/app/Schema/Mysql.php b/app/Schema/Mysql.php
index ab618635..c7293a43 100644
--- a/app/Schema/Mysql.php
+++ b/app/Schema/Mysql.php
@@ -22,8 +22,8 @@ function version_29($pdo)
 {
     $pdo->exec("
         CREATE TABLE settings (
-            option VARCHAR(100) PRIMARY KEY,
-            value VARCHAR(255) DEFAULT ''
+            `option` VARCHAR(100) PRIMARY KEY,
+            `value` VARCHAR(255) DEFAULT ''
         )
     ");
 
diff --git a/vendor/PicoDb/Table.php b/vendor/PicoDb/Table.php
index f13b4e11..9c6bf4f9 100644
--- a/vendor/PicoDb/Table.php
+++ b/vendor/PicoDb/Table.php
@@ -173,6 +173,10 @@ class Table
 
     public function buildSelectQuery()
     {
+        foreach ($this->columns as $key => $value) {
+            $this->columns[$key] = $this->db->escapeIdentifier($value);
+        }
+
         return sprintf(
             'SELECT %s %s FROM %s %s %s %s %s %s %s',
             $this->distinct ? 'DISTINCT' : '',