I had an employment application with a field for "references", and creating the view blew up. In retrospect, this should be obvious since "references" is a reserved word: http://dev.mysql.com/doc/refman/5.5/en/innodb-foreign-key-constraints.html

I quick fixed by changing the field name. No problem. It is, however, slightly concerning that these field names are not sanitized. Can I name a webform field 'OR 1=1;DROP DATABASE drupal;' ? Say it ain't so, Little Bobby Tables, say it ain't so! http://xkcd.com/327/

Comments

usonian’s picture

usonian commented
Title: Error creating view when Webform included field name "references" » Sanitize field names used to build MySQL view to catch reserved keywords
Assigned: Unassigned » usonian

The little Bobby Tables scenario shouldn't come into play - the field names used for the view are taken from webform_component.form_key, not the field label... but the query builder should accommodate fields that happen to be named with reserved keywords - good catch.

usonian’s picture

usonian commented
Title: Sanitize field names used to build MySQL view to catch reserved keywords » Escape field names used to build MySQL view to catch reserved keywords

Field names are now wrapped with backticks when building the View query.

usonian’s picture

usonian commented
Status: Active » Fixed
usonian’s picture

usonian commented
Status: Fixed » Closed (fixed)