bugphpGroupWare - Bugs: bug #8128, An apostrohe in the body field of...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #8128: An apostrohe in the body field of a Wiki page causes SQL error

Submitter:  Louis B. Moore <lbmoore>
Submitted:  Thu 11 Mar 2004 11:31:56 PM UTC
   
 
Category:  wiki Item Group:  0.9.16.000 release
Severity:  3 - Normal Priority:  7 - High
Status:  Fixed Privacy:  Public
Assigned to:  skwashd Open/Closed:  Closed
Component Version:  SVN Operating System:  GNU/Linux - RedHat/Fedora
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Tue 16 Mar 2004 03:37:53 PM UTC, comment #2: 

This has been corrected in CVS.

To grab a complete update of all fixes:

1)  Check to see if you have cvs installed: 'cvs --help'.
1a) If not, install a copy of cvs-cli from your favorite
distro.

2)  Then just type:
    'cd <your phpgroupware dir>; cvs update -dP'.

You can do step 2 as many times in a day as you wish, and
will always get the most current bug fixes.

Thanks,

Dave Hall <skwashd>
Group administrator
Sat 13 Mar 2004 10:05:07 PM UTC, comment #1: 

This function will fail:


function write()
        {
                $this->db->query("INSERT INTO $this->PgTbl".
                                 " (title,version,time,supercede,mutable,username,author,comment,body)".
                                 " VALUES ('$this->dbname',$this->version,".time().','.time().",'".
                                 ($this->mutable ? 'on' : 'off') . "','$this->username','$this->hostname',".
                                 "'$this->comment','$this->text')",__LINE__,__FILE__);



Slightly modified it works:


        function write()
        {
                $this->db->query("INSERT INTO $this->PgTbl".
                                 " (title,version,time,supercede,mutable,username,author,comment,body)".
                                 " VALUES ('$this->dbname',$this->version,".time().','.time().",'".
                                 ($this->mutable ? 'on' : 'off') . "','$this->username','$this->hostname','".
                                 addslashes($this->comment). "','" .addslashes($this->text)."')",__LINE__,__FILE__);





Louis B. Moore <lbmoore>
Thu 11 Mar 2004 11:31:56 PM UTC, original submission:  

For an example, try to add a new page with the text: Whoa dog's will cause this problem, the fields are not quoting apostrophes. The resultant mess can delete the page!

Database error: Invalid SQL: INSERT INTO phpgw_wiki_pages (title,version,time,supercede,mutable,username,author,comment,body) VALUES ('LouisWikiTest',1,1079047179,1079047179,'on','lbmoore','separata.thechildrenshospital.org','',' Whoa dog's ')
PostgreSQL Error: 1 (ERROR: parser: parse error at or near "s" at character 211 )

File: /var/www/phpgroupware/wiki/inc/class.sowiki.inc.php
Line: 116

Session halted.


See also Bugs #7654

Louis B. Moore <lbmoore>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2004-03-16 skwashd StatusNone Fixed
    Assigned toNone skwashd
    Open/ClosedOpen Closed
2004-03-11 lbmoore Carbon-Copy- Added ned --AT-- atrust --DOT-- com

Back to the top

Powered by Savane 3.13-3230.
Corresponding source code