Bug #8546

column/table names are not escaped in SQL queries

Details

Submitted	2006-08-23 20:55 UTC
From	clouserw at gmail dot com
Assigned	quipo
Status	Closed
Package	Translation2
PHP Version	4.3.9
OS	redhat
Roadmaps	(Not assigned)

Comments

[2006-08-23 20:55 UTC] clouserw at gmail dot com

Description:
------------
The software I'm working on needs to differentiate region from language, which means I have columns in my "strings" table named, for example, "en-US" and "en-GB" instead of just "en".

The dash breaks sql queries because they are built without quoting the columns. For example, in getStringId() in /Container/db.php ( http://cvs.php.net/viewvc.cgi/pear/Translation2/Container/db.php?revision=1.30&view=markup ) you can see sprintf() is used, but no quoting.

Thanks

Test script:
---------------
<?php
// After putting in the appropriate column in your `strings`
// table and the value in your `lang` table:

$this->translation->setLang('en-US');

Expected result:
----------------
I expect it to not get an error.

Actual result:
--------------
A PEAR error with the following info:

[code] => -19
[message] => DB Error: no such field
[userinfo] => SELECT translated_column, en-US FROM translations WHERE pk_column = 'Addons' [nativecode=1054 ** Unknown column 'en' in 'field list']

[2006-09-05 22:39 UTC] clouserw at gmail dot com

Looks like your patch did the trick. I no longer get the error when using the CVS version.

I'm using mysql 4.1.20.