Security: Validate and safely quote installer database identifiers

[fvent01]

Finding

The installer interpolates the user-supplied database name directly into CREATE DATABASE IF NOT EXISTS ... and `USE `... statements. Casting is applied to the port, but the database identifier is not constrained to a safe identifier grammar or escaped as a MySQL identifier.

Risk

A crafted database name containing backticks or SQL syntax may alter the intended statement. Depending on PDO/MySQL statement handling and account privileges, this can cause SQL injection, unauthorized schema changes, or destructive database operations during installation.

Evidence

• $dbName comes from $_POST['db_name'].
• The installer executes CREATE DATABASE IF NOT EXISTS {$dbName} ....
• It later executes USE {$dbName}``.
• Prepared-statement placeholders cannot be used for identifiers, so explicit validation/quoting is required.

Recommended remediation

• Restrict database names to a conservative grammar such as ^[A-Za-z0-9_]{1,64}$.
• Reject backticks, whitespace, separators, comments, and control characters.
• Centralize MySQL identifier quoting rather than interpolating raw values.
• Use a minimally privileged installer account and drop database-creation privileges after setup.
• Avoid returning raw PDO exception text to the browser.
• Add tests with malicious identifier payloads.

Acceptance criteria

• Database identifiers outside the documented safe grammar are rejected.
• Backticks, comments, whitespace tricks, and statement separators cannot alter SQL.
• Installation works with valid existing and newly created database names.
• Raw database errors are not exposed remotely.
• Tests cover identifier injection payloads and boundary lengths.

Priority

P0 — installer SQL injection risk.