Remove excessive SQL quotes filtering adding risk to queries (done better) - refs BT#13285

Author: ywarnier

main/inc/lib/database.lib.php

@@ -248,8 +248,12 @@ public static function escape_sql_wildcards($text)
     public static function escape_string($string)
     {
         $string = self::getManager()->getConnection()->quote($string);
-
-        return trim($string, "'");
+        // The quote method from PDO also adds quotes around the string, which
+        // is not how the legacy mysql_real_escape_string() was used in
+        // Chamilo, so we need to remove the quotes around. Using trim will
+        // remove more than one quote if they are sequenced, generating
+        // broken queries and SQL injection risks
+        return substr($string, 1, -1);
     }
 
     /**