When trying to upload a file that had an apostrophy in the author's name, an SQL error occured. It seems values aren't being escaped before being entered into the database, though keys are. I'd have thought it should be the other way around?

I've attached a patch which adds this, unless there is some reason why values shouldn't be checked?

CommentFileSizeAuthor
filestore_escaping.diff683 bytesgeodaniel

Comments

bluegeek9’s picture

bluegeek9 commented
Assigned: geodaniel » Unassigned
Issue summary: View changes
Status: Needs review » Closed (outdated)

Thank you for your contributions to this issue. As Drupal 4 has reached its End of Life and is no longer supported, we are closing this issue. We encourage you to upgrade to a supported version of Drupal.