From 447db0a97af7e3865951aefc0218b0fcdc8039ac Mon Sep 17 00:00:00 2001
From: Lufei <lufei@easycorp.ltd>
Date: Wed, 14 Dec 2022 09:37:00 +0800
Subject: [PATCH] * Fix sql injection when importing jira.

close GH-106
---
 module/convert/model.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/module/convert/model.php b/module/convert/model.php
index dbb5055f98..41fd33e9e0 100644
--- a/module/convert/model.php
+++ b/module/convert/model.php
@@ -41,12 +41,13 @@ class convertModel extends model
      * Check database exits or not.
      *
      * @access public
-     * @return bool
+     * @return object|false
      */
     public function dbExists($dbName = '')
     {
-        $sql = "SHOW DATABASES like '{$dbName}'";
-        return $this->dbh->query($sql)->fetch();
+        $statement = $this->dbh->prepare('SHOW DATABASES like ?');
+        $statement->execute([$dbName]);
+        return $statement->fetch();
     }
 
     /**