Improve : add a function for detection SQL inject

include/lib/database_core.class.php

@@ -956,6 +956,24 @@ class DatabaseCore
     static  function nb_column($p_ret) {
         return pg_num_fields($p_ret);
     }
+    /**
+     * FInd if a SQL Select has a SQL stmt to inject or damage Data
+     * When a SELECT SQL string is build, this string could contain a SQL attempt to damage data,
+     *so the statement DELETE TRUNCATE ... are forbidden. Throw an exception EXC_INVALID
+     *
+     */
+    function search_sql_inject($p_sql)
+    {
+        $forbid_sql=array("update","delete","truncate","insert");
+        // protect against SQL inject
+        foreach ($forbid_sql as $forbid_key) {
+            if (stripos($p_sql,$forbid_key) !== false)
+            {
+                throw new Exception(_("Possible SQL inject",EXC_INVALID));
+            }
+
+        }
+    }
 
 }