user error: You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'dd%' OR c.comment LIKE '% he'dd %') ORDER BY c.timestamp DESC L query: SELECT c.*, u.name FROM comments c INNER JOIN users u ON c.uid = u.uid WHERE c.status = 0 AND (c.subject LIKE '%he'dd%' OR c.comment LIKE '% he'dd %') ORDER BY c.timestamp DESC LIMIT 0, 26 in xxxx../includes/database.mysql.inc on line 97.

CommentFileSizeAuthor
#3 addslashes_trip_search.patch1.15 KBgreggles

Comments

nedjo’s picture

nedjo
he/him/his
Primary language English
commented

Looks like the problem is in an apostrophe (') in the search term. This would need to be escaped by the module. Presumably, the module should it use the addslashes() function before passing into the SQL statement.

Leeteq’s picture

Leeteq commented
Version: 4.4.x-1.x-dev » 4.6.x-1.x-dev

Bump. This is still a problem in the 4.6 version. Will it not be fixed for 4.6? Or is there a patch somewhere?

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented
Status: Active » Needs review
StatusFileSize
new addslashes_trip_search.patch1.15 KB

Here's a patch to fix this problem.

I think I got both situations where this could be a problem, but I welcome a review.

joel_guesclin’s picture

joel_guesclin commented

This should be fixed in the 4.7 version

joel_guesclin’s picture

joel_guesclin commented
Status: Needs review » Fixed
joel_guesclin’s picture

joel_guesclin commented
Status: Fixed » Closed (fixed)

I'm closing all requests raised on the 4.6 version since I don't intend to continue maintaining this. Hope this causes no problems.

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Well, it is a problem insofar as any 4.6 site out there will be bitten by this bug. It isn't a problem in the next few months because people will be upgrading to 4.7 and will likely no longer need 4.6.

Thanks for the status update.