Consider the following two queries:

$result = db_query("SELECT nid, title FROM {node} WHERE type = 'article'"); // OK
$result = db_query('SELECT nid, title FROM {node} WHERE type = "article"'); // Fails

which should be identical in any database system that I'm familiar with.

The first one works, the second results in

Error message
PDOException: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'article' in 'where clause': SELECT nid, title from {node} where type = "article"; Array ( ) in db_quotes_bug_page() (line 26 of /home/rfay/workspace/d7git/sites/all/modules/oneoff/db_quotes_bug/db_quotes_bug.module).

What I did: Used the second query
What I expected: A basic successful response to a simple static query
What I got instead: A PDOException.

I've tested a number of different queries, and it appears that this is just a problem with double quotes in the where clause.

The demo module I was using to test is attached.

CommentFileSizeAuthor
#1 db_quotes_bug.tgz659 bytesrfay

Comments

rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented
StatusFileSize
new db_quotes_bug.tgz659 bytes

Attachment (demonstration module) got lost. Not sure why that happens so often.

damien tournoud’s picture

damien tournoud commented
Status: Active » Closed (won't fix)

You are not supposed to use *any* quotes in static queries. See discussion in #783814: db_query() should whitelist queries.

rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented

I answered over there, but repeating here:

I certainly think that:

  • If quotes aren't allowed they shouldn't be allowed (single or double)
  • This should be mentioned somewhere in the static queries docs page: http://drupal.org/node/310072