- Moderated by:
- Support
NS-AddStory MySQL errors with ' FIX
-
- rank:
-
Freshman
- registered:
- September 2003
- Status:
- offline
- last visit:
- 17.07.04
- Posts:
- 9
Running:
PostNuke 0.750RC-3 (problem occured when we were running 0.726 too)
Red Hat Enterprise
PHP Version 4.3.7
Apache/1.3.31 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.3.7 FrontPage/5.0.2.2634a mod_ssl/2.8.18 OpenSSL/0.9.7a
MySQL Version 3.23.49
Every time a larger news article is posted we get this error:
Code
stories->postAdminStory: Error accesing to the database
Program: [webroot]/modules/NS-AddStory/admin.php - Line N.: 1097
Database: edkingdo_site
Error (1064) : You have an error in your SQL syntax. Check the manual that corresponds to your mysql server version for the right syntax to use near 'Best Visual Effects in a TV series'...
The error usually occurs around places where there are apostrophes. Posting something short without any HTML in it works. I believe the problem is in the apostrophes, however I have failed to solve it. Any ideas?
-
- rank:
-
Legend
- registered:
- December 1969
- Status:
- online
- Posts:
- 6534
Link to a phpinfo report?
-
- rank:
-
Freshman
- registered:
- September 2003
- Status:
- offline
- last visit:
- 17.07.04
- Posts:
- 9
Problem fixed.
Fix:
In modules/NS-AddStory/admin.php
Lines 1004 - 1012 are:
Code
'" . pnVarPrepForStore($subject) . "',
now(),
'" . pnVarPrepForStore($hometext) . "',
'" . pnVarPrepForStore($bodytext) . "',
'0',
'0',
'" . pnVarPrepForStore($topic) . "',
'" . pnVarPrepForStore($name) . "',
'" . pnVarPrepForStore($notes) . "',
'" . pnVarPrepForStore($ihome) . "',
Replace with:
Code
'" . mysql_escape_string(pnVarPrepForStore($subject)) . "',
now(),
'" . mysql_escape_string(pnVarPrepForStore($hometext)) . "',
'" . mysql_escape_string(pnVarPrepForStore($bodytext)) . "',
'0',
'0',
'" . pnVarPrepForStore($topic) . "',
'" . pnVarPrepForStore($name) . "',
'" . mysql_escape_string(pnVarPrepForStore($notes)) . "',
For explanation look into the PHP manual. Search for mysql_escape_string
|
