Package home | Report new bug | New search | Development Roadmap Status: Open | Feedback | All | Closed Since Version 2.0.4

Bug #8546 column/table names are not escaped in SQL queries
Submitted: 2006-08-23 15:55 UTC Modified: 2006-10-31 09:01 UTC
From: clouserw at gmail dot com Assigned: quipo
Status: Closed Package: Translation2 (version 2.0.0beta10)
PHP Version: 4.3.9 OS: redhat
Roadmaps: (Not assigned)    
Subscription  


 [2006-08-23 15:55 UTC] clouserw at gmail dot com (Wil Clouser)
Description: ------------ The software I'm working on needs to differentiate region from language, which means I have columns in my "strings" table named, for example, "en-US" and "en-GB" instead of just "en". The dash breaks sql queries because they are built without quoting the columns. For example, in getStringId() in /Container/db.php ( http://cvs.php.net/viewvc.cgi/pear/Translation2/Container/db.php?revision=1.30&view=markup ) you can see sprintf() is used, but no quoting. Thanks Test script: --------------- <?php // After putting in the appropriate column in your `strings` // table and the value in your `lang` table: $this->translation->setLang('en-US'); ?> Expected result: ---------------- I expect it to not get an error. Actual result: -------------- A PEAR error with the following info: [code] => -19 [message] => DB Error: no such field [userinfo] => SELECT translated_column, en-US FROM translations WHERE pk_column = 'Addons' [nativecode=1054 ** Unknown column 'en' in 'field list']

Comments

 [2006-08-29 05:01 UTC] quipo (Lorenzo Alberton)
Hi, I've added a call to quoteIdentifier() in every query, can you check the CVS version and tell me if it works as expected? Also, what dbms are you using?
 [2006-09-05 17:39 UTC] clouserw at gmail dot com
Looks like your patch did the trick. I no longer get the error when using the CVS version. I'm using mysql 4.1.20.
 [2006-10-31 08:43 UTC] mick (Michael Heuberger)
Hello That's not true, the bug is still there: In class db.php in method addLang() the index names aren't still surrounded with the quote identifier. Please fix it. You can see my workaround below. Best regards from Switzerland Mick --- My workaround: --- $indexName = $langData['table_name'] . '_' . $this->options['string_page_id_col'] . '_' . $this->options['string_id_col'] . '_index'; $queries[] = sprintf('CREATE UNIQUE INDEX %s ON %s (%s, %s%s)', $this->db->quoteIdentifier($indexName), $this->db->quoteIdentifier($langData['table_name']), $this->db->quoteIdentifier($this->options['string_page_id_col']), $this->db->quoteIdentifier($this->options['string_id_col']), $mysqlClause ); $indexName = $langData['table_name'] . '_' . $this->options['string_page_id_col'] . '_index'; $queries[] = sprintf('CREATE INDEX %s ON %s (%s)', $this->db->quoteIdentifier($indexName), $this->db->quoteIdentifier($langData['table_name']), $this->db->quoteIdentifier($this->options['string_page_id_col']) ); $indexName = $langData['table_name'] . '_' . $this->options['string_id_col'] . '_index'; $queries[] = sprintf('CREATE INDEX %s ON %s (%s%s)', $this->db->quoteIdentifier($indexName), $this->db->quoteIdentifier($langData['table_name']), $this->db->quoteIdentifier($this->options['string_id_col']), $mysqlClause );
 [2006-10-31 09:01 UTC] quipo (Lorenzo Alberton)
please fetch the CVS version and tell me if it's fixed.