SQL in taxonomy_get_term_by_name() should use =, not LIKE
Heine - October 3, 2007 - 22:44
| Project: | Drupal |
| Version: | 5.x-dev |
| Component: | taxonomy.module |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
Description
Reported by John Morahan
Drupal 5.2 taxonomy.module
If a user uses free tagging to add a '%' symbol as a tag, it is
impossible for anyone to add any further tags as they all get changed to
'%'.
This is because taxonomy_get_term_by_name() does a 'LIKE' match instead
of '='.
Someone with 'administer taxonomy' permission can manually delete the
offending term, fixing the problem until it gets added again.
Related issue (6.x): http://drupal.org/node/165160
To reproduce:
1. create a free tagging vocabulary, assign to a node type
2. create a node of that type, add % as a tag
3. edit the node, or create a new node of that type, add different tags,
and save again
4. observe that % was saved as a tag, and any other tags were not
#1
This still applies, and this can also be tested on groups.drupal.org. For instance if you try to enter "3rd party software" as a tag, it will get replaced with "3%" since it appears someone added that as a tag already. This is not a critical issue but really should be fixed because it interferes with the user experience and is experienced as a bug (which it is).
#2
#3
#4
Applied the patch and followed the steps above, no problems.
#5
Applies cleanly and works as advertised.
#6
This issue still exists in D6.
#7
Well, in D6 the order was reversed, so it's not exactly the same issue: it's now impossible to add a tag with % in it, if the pattern matches an existing tag. Still a problem though.
#8
This bug and corresponding patch still apply. Please do not forget to backport this to D5.
#9
Clarified title.
#10
Thanks, committed. Should also be fixed in Drupal 5 and Drupal 7. Putting to Drupal 7 first, because it has the same code (presumably), so it should be easy to commit there and then set back for Drupal 5.
#11
Committed this to CVS HEAD. Thanks John. Changing version.
#12
Committed to 5.x
#13
To get better performance, may want to use strtolower first instead of inside the SQL:
$db_result = db_query(db_rewrite_sql("SELECT t.tid, t.* FROM {term_data} t WHERE LOWER(t.name) = '%s' ", 't', 'tid'), strtolower(trim($name)));
#14
Automatically closed -- issue fixed for two weeks with no activity.