From 1abd48d958ae433fd9114a65dab14bfde97b5494 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Sun, 21 Mar 2021 13:20:59 -0700
Subject: [PATCH] Table names always need quoting
 https://github.com/virtualmin/virtualmin-gpl/issues/258

---
 postgresql/drop_dbase.cgi | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/postgresql/drop_dbase.cgi b/postgresql/drop_dbase.cgi
index 2d9b5487c..98b092c9d 100755
--- a/postgresql/drop_dbase.cgi
+++ b/postgresql/drop_dbase.cgi
@@ -8,7 +8,8 @@ require './postgresql-lib.pl';
 &can_edit_db($in{'db'}) || &error($text{'dbase_ecannot'});
 if ($in{'confirm'}) {
 	# Drop the database
-	&execute_sql_logged($config{'basedb'}, "drop database \"$in{'db'}\"");
+	&execute_sql_logged($config{'basedb'},
+			    "drop database ".&quote_table($in{'db'}));
 	&delete_database_backup_job($in{'db'});
 	&webmin_log("delete", "db", $in{'db'});
 	&redirect("");
@@ -19,7 +20,8 @@ else {
 	@tables = &list_tables($in{'db'});
 	$rows = 0;
 	foreach $t (@tables) {
-		$d = &execute_sql($in{'db'}, "select count(*) from $t");
+		$d = &execute_sql($in{'db'},
+				  "select count(*) from ".&quote_table($t));
 		$rows += $d->{'data'}->[0]->[0];
 		}