Hi Alain & list!
Quick example of the way to face the bug #439565: - create a table with one column of type TEXT or VARCHAR(20); - insert a record with the value: 'say "hello"' (with the doubles quotes) - now browse the table and try to modify/delete this record with the links displayed at the browse screen.
That's all folks ;)
Regards, Loïc
______________________________________________________________________________ ifrance.com, l'email gratuit le plus complet de l'Internet ! vos emails depuis un navigateur, en POP3, sur Minitel, sur le WAP... http://www.ifrance.com/_reloc/email.emailif
Hi Loïc,
Quick example of the way to face the bug #439565:
- create a table with one column of type TEXT or VARCHAR(20);
- insert a record with the value: 'say "hello"' (with the doubles quotes)
- now browse the table and try to modify/delete this record with the links displayed at the browse screen.
I didn't thought it was so easy to trigger, so I tried ... and your example is sadly right :-{ Looks like a major bug to me ...
Alain.
Re:
Quick example of the way to face the bug #439565:
- create a table with one column of type TEXT or VARCHAR(20);
- insert a record with the value: 'say "hello"' (with the doubles quotes)
- now browse the table and try to modify/delete this record with the links displayed at the browse screen.<<
Hi All
if this problem is just about 'tick' characters then here is a function that will sort is out, this function will fix queries like
insert into symbolic (name) values(''say "hello"'')
where the inner tick characters need escaping, the function will turn the query in to this
insert into symbolic (name) values(''say "hello"'')
***** change these lines in db_readdump *****
// sql.php will stripslash the query if get_magic_quotes_gpc if (get_magic_quotes_gpc() == 1) $sql_query = addslashes($sql_query); include("./sql.php");
****** to this **********
// sql.php will stripslash the query if get_magic_quotes_gpc // if (get_magic_quotes_gpc() == 1) $sql_query = addslashes($sql_query); $sql_query = do_ticks($sql_query); include("./sql.php");
********** Include this function ***********
function do_ticks($sql) { $tok = split (",",$sql); $sql = ""; $t = count($tok); for ($j=0; $j<$t; $j++) { $parts = split ("'",$tok[0]); $c = count($parts); if($c > 3) { for ($i=0; $i<$c; $i++) { if($i > 0 && $i < $c - 2) { $parts[$i] .= "\'"; } else { $parts[$i] .= "'"; } } $sql .= implode ("",$parts); if($t == 1) $sql = substr ($sql, 0, strlen($sql)-1); $sql .= ","; } else { $sql .= implode ("",$parts).","; } } $sql = substr ($sql, 0, strlen($sql)-1); return($sql); }
Hope this helps Pete Kelly
----- Original Message ----- From: "Loïc" loic-div@ifrance.com To: "phpMyAdmin" phpmyadmin-devel@lists.sourceforge.net Sent: Thursday, July 19, 2001 10:14 PM Subject: [Phpmyadmin-devel] Re: Using single quotes for better performances
Hi Alain & list!
Quick example of the way to face the bug #439565:
- create a table with one column of type TEXT or VARCHAR(20);
- insert a record with the value: 'say "hello"' (with the doubles quotes)
- now browse the table and try to modify/delete this record with the links displayed at the browse screen.
That's all folks ;)
Regards, Loïc
____________________________________________________________________________ __
ifrance.com, l'email gratuit le plus complet de l'Internet ! vos emails depuis un navigateur, en POP3, sur Minitel, sur le WAP... http://www.ifrance.com/_reloc/email.emailif
Phpmyadmin-devel mailing list Phpmyadmin-devel@lists.sourceforge.net http://lists.sourceforge.net/lists/listinfo/phpmyadmin-devel
Folks,
While I don't like this bug, I don't think it's a showstopper. Correct me if I'm wrong, but the bug is only triggered if a table does not have a primary key (ok, maybe a primary key with 'say "hello"' in it would trigger it, but this would be a very unusual kind of primary key).
So in real life, probably people won't face it too often, and it could wait after 2.2.0.
Marc
Loïc a écrit :
Hi Alain & list!
Quick example of the way to face the bug #439565:
- create a table with one column of type TEXT or VARCHAR(20);
- insert a record with the value: 'say "hello"' (with the doubles quotes)
- now browse the table and try to modify/delete this record with the links displayed at the browse screen.
That's all folks ;)