Part of the EllisLab Network

Bug Report

Update_string and Insert_string do not escape the key correctly

Date: 05/10/2008 Severity: Major
Status: New Reporter: Cheater
Version: 1.6.2 SVN
Keywords: Libraries, Database Class

Description

At least for MySQL, if you use the update_string or insert_string with certain keys (e.g. ‘desc’ for description) then MySQL will barf and it usually takes a couple of days to figure out why if you havent encountered it before. smile

The problem is MySQL thinks its DESC from a ORDER BY.
Fields in queries should *always* have backticks around them which tell MySQL that its a field.

The fix is simple. For the update code, change it to this:
foreach($values as $key => $val)
{
$valstr[] = “`$key` = `$val`”;
}
Insert Code:
return “INSERT INTO “.$this->_escape_table($table).” (`”.implode(’`, `’, $keys)."`) VALUES (”.implode(’, ‘, $values).")";

This bug is probably elsewhere in the code but I’ve only stumbled across it here.

Expected Result

Actual Result

Comment on Bug Report

Name:

Email:

Location:

URL:

Remember my personal information

Notify me of follow-up comments?