Bug #2037

missing quoting in Admin/Auth/Container/DB.php

Details

Submitted	2004-08-01 11:12 UTC
From	tschlottke at virtualminds dot de
Assigned	dufuz
Status	Closed
Package	LiveUser
PHP Version	5.0.0
OS	irrelevant
Roadmaps	(Not assigned)

Comments

[2004-08-01 11:12 UTC] tschlottke at virtualminds dot de

Description:
------------
in method getUsers();

if $filters array is supplied, you should also quote the values:

$where .= " $f=$v" . $cond;

should be:

$where .= " $f=" . $this->dbc->quoteSmart($v) . $cond;

Reproduce code:
---------------
list($user) = $admin->auth->getUsers(array('handle'=>'franz'));

Expected result:
----------------
userdata

Actual result:
--------------
db-error ;)

[2004-08-01 11:22 UTC] smith at backendmedia dot com

Actually I am not entirely sure if we really want this option. Its easy to use, yet to me it does feel a bit like bloat. Moreover I dont beleive in this entire quoteSmart() idea. MDB2 has similar handling, however it seems to be like a runtime performance killer. If you want to have something escaped/quoted it seems to make more sense to me to explicitly ask for the proper quoting instead of letting the abstraction layer do the guessing.

[2004-08-01 11:22 UTC] tschlottke at virtualminds dot de

would be neat if i could submit my following reports via e-mail,
got some small fixes and
i hate this bug-form :(

-Tobi

[2004-08-01 11:26 UTC] tschlottke at virtualminds dot de

well, i just wrote that you should use quoteSmart() because you used it in all other places.
but IMHO the abstraction layer should quote the filter string - this makes programming a bit "smoother" to the user.
otherwise you should also remove all other quoteSmart()-calls, to be correct - and leave it to the users ;-)))

-Tobi

[2004-08-01 11:34 UTC] smith at backendmedia dot com

Well to clarify: our recommended backend is MDB (not MDB2 since is not yet stable). The main reason for that is that MDB is more portable than the DB backend. So what I am saying is that I dont want the MDB container behave differently than the DB or MDB2 container.