DHX_SECURITY_SAFEHTML adds "\r" to SQL

Suite and Optimus Suite 5
#1

I was getting an error in my connector when I used the following line:
ConnectorSecurity::$xss = DHX_SECURITY_SAFEHTML;

The error was a SQL syntax error. When I looked at the log the connector created, it looks like there was a \r being added after each value in the UPDATE statement, which caused the MySQL error.

If I use DHX_SECURITY_TRUSTED, the error does not occur. For my application, it’s probably safe enough to use the DHX_SECURITY_TRUSTED, but I thought I should at least report the issue.

#2

If you are using php connectors - please try to update to the latest version

github.com/dhtmlx/connector-php

If issue still occurs - please share the full php code, as I can’t reconstruct the same problem with local samples.