The inner quote separators in the 'IN' part are escaped.

Take "Node : Type" filter, for instance.
It ends up in the final query as something like :

WHERE (node.type  IN ('page\',\'image'))

meaning that this selects the nodes whose type is page','image, which of course brings no result.

CommentFileSizeAuthor
#4 views_query.inc_1.patch891 bytesyched
#2 views_query.inc_0.patch751 byteseaton

Comments

merlinofchaos’s picture

merlinofchaos commented

Oh geez. I'm a dork, I completely forgot %s substitution would do that.

I'll try to fix that tonight.

eaton’s picture

eaton commented
Status: Active » Needs review
StatusFileSize
new views_query.inc_0.patch751 bytes

Simple patch, though I'm not sure whether this is a security issue (we're not sending things through %s, now).

merlinofchaos’s picture

merlinofchaos commented

I think you're right, we need to run the entire array through db_escape_slashes I think, which may mean foregoing implode and constructing it manually.

yched’s picture

yched commented
StatusFileSize
new views_query.inc_1.patch891 bytes

what about this patch ?
It's not that pretty, but it should ensure proper escaping. What do you think ?

yched’s picture

yched commented

PS : array_fill is not used anywhere in core (nor in any contrib module I currently use...) so I doublechecked :
PHP manual says the function exists from PHP 4.2 on, which I guess means OK for us since drupal requirements are 4.3.3+.

merlinofchaos’s picture

merlinofchaos commented
Status: Needs review » Fixed

Committed this patch.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)