Bug #9859

Empty strings are treated as booleans

Details

Submitted	2007-01-17 21:45 UTC
From	gahorth1234 at yahoo dot co dot uk
Assigned	aharvey
Status	Bogus
Package	DB
PHP Version	5.2.0
OS	Suse Linux 10.2
Roadmaps	(Not assigned)

Comments

[2007-01-17 21:45 UTC] gahorth1234 at yahoo dot co dot uk

Description:
------------
I've noticed that if my SQL query contains an empty string as one of the values, "smartQuote" in common.php treats this value as a boolean and so stores a zero in the database, instead of an empty string as expected.

e.g.
$db->query("UPDATE `Stock` SET `Spec` = ?", array(substr('',0,255)));

Obviously the "substr" function above would normally have a proper string in it! But if it's from, say $_POST or $_GET, and that field was left blank on the form, the query then becomes "UPDATE `Stock` SET `Spec` = 0" (from the mysql log).

It could be that this is actually considered a PHP problem, but a quick fix (for me) is to replace the following line in common.php within the "smartQuote" function (line 429 in common.php from DB release 1.7.7):

Original line:
} elseif (is_bool($in)) {

My replaced line:
} elseif (is_bool($in) && !empty($in)) {

Test script:
---------------
$db->query("UPDATE `Stock` SET `Spec` = ?", array(substr($_GET['value'],0,255)));

Expected result:
----------------
UPDATE `Stock` SET `Spec` = ''

Actual result:
--------------
UPDATE `Stock` SET `Spec` = 0