Merge pull request from GHSA-fvrf-9428-527m

Security Update for SQLi for Magento 2
OpenMage · Apr 19, 2021 · 368a585 · luigifab · Apr 20, 2021 · 368a585
2 parents 56cf1f1 + 093a79b
commit 368a585
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/lib/Varien/Db/Adapter/Pdo/Mysql.php b/lib/Varien/Db/Adapter/Pdo/Mysql.php
@@ -3001,9 +3001,8 @@ public function prepareSqlCondition($fieldName, $condition)
      */
     protected function _prepareQuotedSqlCondition($text, $value, $fieldName)
     {
-        $sql = $this->quoteInto($text, $value);
-        $sql = str_replace('{{fieldName}}', $fieldName, $sql);
-        return $sql;
+      $text = str_replace('{{fieldName}}', $fieldName, $text);
+      return $this->quoteInto($text, $value);
     }
 
     /**