Filtering string values

[stevenmiller]

Hello,

I have built select filter objects in the launch form and I am passing the sql statements by id into sql of a browse form.

This is an example:
select object with id Filter1 : I am choosing between ✔ and -

AND field1=1|✔|
AND field1=0|-

And then it is passed to sql that looks like this:
SELECT * FROM table1
WHERE fieldx=1
#Filter1#

It works successfully.

But when it comes to string values, there is an error:
example:
select object with id Filter2:

AND field3='Cat'|Cat|
AND field3='Dog'|Dog

And then it is passed to sql that looks like this:
SELECT * FROM table1
WHERE fieldx=1
#Filter2#

The form does not get filtered and it breaks down with error:
===PDO MESSAGE===

SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'Cat\' at line 3

So basically he passes backslash into the statement and the statement breaks down

Any ides how to fix this?

[kev1n]

Hi,

Try the following:

Replace this line in nuform.php

Code: Select all

$S				= new nuSqlString(nuReplaceHashVariables($r->sfo_browse_sql));

with

Code: Select all

$S				= new nuSqlString(stripslashes(nuReplaceHashVariables($r->sfo_browse_sql)));

I'll have to take a closer look at it later to see if there are any undesirable side effects.