contao/issues — Issue #773: SQL Columns are not escaped in Form.php when saving form data
Author: importer
Created: 2011-11-24 16:00:33+00:00
State: open
Labels: Defect, frontend, Invalid

This can result in SQL Errors by using column names like "pre-part" and security issues.

Can be found at line 392 in Form.php:

```
// Fields
foreach ($arrSubmitted as $k=>$v)
{
if ($k != 'cc' && $k != 'id')
{
$arrSet[$k] = $v;
}
}
```

Possible Solution (already tested):

```
// Fields
foreach ($arrSubmitted as $k=>$v)
{
if ($k != 'cc' && $k != 'id')
{
$arrSet['`'.$k.'`'] = $v;
}
}
```

--- _Originally created by anonymous on June 4th, 2009, at 08:11pm (ID 773)_