If you allow the `'`-Character for files (because you have an extensive folder structure already and do not want to change it), you can now inject SQL code using file or folder names.

It would be better to either use SQL parameters or - if that is too big of a refactor - escape _all_ user input before it goes into an SQL statement.

Example config:

```PHP
$conf['sync_chars_regex'] = '/^[-A-Za-zŽžÀ-ÿ0-9._\' ,)~(]+$/';
```

Error message:
```
Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax;
check the manual that corresponds to your MariaDB server version for the right syntax to use near 
    's 50ter','Burkhard's 50ter','1','3','2,3,20','true','true','public','15'...' 
at line 21 in /volume1/web/include/dblayer/functions_mysqli.inc.php:132

Stack trace:
#0 /volume1/web/include/dblayer/functions_mysqli.inc.php(132): mysqli->query('\nINSERT INTO `...')
#1 /volume1/web/include/dblayer/functions_mysqli.inc.php(550): pwg_query('\nINSERT INTO `...')
#2 /volume1/web/admin/site_update.php(313): mass_inserts('categories', Array, Array)
#3 /volume1/web/admin.php(346): include('/volume1/web/ad...')
#4 {main} thrown in /volume1/web/include/dblayer/functions_mysqli.inc.php on line 132
```
SQL-Injection Attack for certain configurations
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : SQL-Injection Attack for certain configurations
Issue date:

--- start body ---
If you allow the `'`-Character for files (because you have an extensive folder structure already and do not want to change it), you can now inject SQL code using file or folder names.

It would be better to either use SQL parameters or - if that is too big of a refactor - escape _all_ user input before it goes into an SQL statement.

Example config:

```PHP
$conf['sync_chars_regex'] = '/^[-A-Za-zŽžÀ-ÿ0-9._\' ,)~(]+$/';
```

Error message:
```
Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax;
check the manual that corresponds to your MariaDB server version for the right syntax to use near 
    's 50ter','Burkhard's 50ter','1','3','2,3,20','true','true','public','15'...' 
at line 21 in /volume1/web/include/dblayer/functions_mysqli.inc.php:132

Stack trace:
#0 /volume1/web/include/dblayer/functions_mysqli.inc.php(132): mysqli->query('\nINSERT INTO `...')
#1 /volume1/web/include/dblayer/functions_mysqli.inc.php(550): pwg_query('\nINSERT INTO `...')
#2 /volume1/web/admin/site_update.php(313): mass_inserts('categories', Array, Array)
#3 /volume1/web/admin.php(346): include('/volume1/web/ad...')
#4 {main} thrown in /volume1/web/include/dblayer/functions_mysqli.inc.php on line 132
```
--- end body ---
