Bug #1231

Wrong escaping of ampersand char '&'

Details

Submitted	2004-04-17 18:36 UTC
From	signup at cheapweb dot it
Assigned	danielc
Status	Bogus
Package	DB
PHP Version	4.3.4
OS	Linux
Roadmaps	(Not assigned)

Comments

[2004-04-17 18:36 UTC] signup at cheapweb dot it

Description:
------------
It seems to be a deficiency in the field escaping mechanism when I use DB::prepare() and DB::execute(). If data in a field contains an ampersand ('&') the char is (wrongly) escaped. Actually the ampersand should not be escaped at all.

The commented code wich does the same work of DB::prepare() and DB::execute() statements works fine -

Reproduce code:
---------------
// $statement = "INSERT INTO visualmedia (visualmedia_nome, visualmedia_idEvento, visualmedia_categoria, " . "visualmedia_dir, visualmedia_width, visualmedia_height, visualmedia_data, " .
"visualmedia_tipo) " .
"VALUES ('{$row[0]}', '$idEvento', '$categoria', '$dir', '{$row[1]}', " .
"'{$row[2]}', '{$row[3]}', '{$row[4]}')";
// $res = $dbh->query($statement);
// $statement = "INSERT INTO visualmedia (visualmedia_nome, visualmedia_idEvento, visualmedia_categoria, " . "visualmedia_dir, visualmedia_width, visualmedia_height, visualmedia_data, " .
"visualmedia_tipo) " .
"VALUES (?, '$idEvento', '$categoria', '$dir', ?, " .
"?, ?, ?)";
$dbh->prepare($statement);
$res = $dbh->execute($sth, $row);

Expected result:
----------------
A valid query

Actual result:
--------------
Suppose that $row[1] == 'x&y' it becomes escaped as 'x\\&y' wich leads to an unsuccesful query