Bug #9933

Special characters are beeing stored in a wrong way

Details

Submitted	2007-01-24 12:41 UTC
From	brain dot workDELETEME at gmx dot net
Status	Closed
Package	MDB2_Driver_oci8
PHP Version	5.0.5
OS	irrelevant
Roadmaps	(Not assigned)

Comments

[2007-01-24 12:41 UTC] brain dot workDELETEME at gmx dot net

Description:
------------
Trying to store some text in the oracle database the special characters of this text are escaped with the command "$quotedCharacters = $db->quote( $characters )".

When $quotedCharacters is saved to the database the value in the database is also escaped.

Test script:
---------------
<?php
$sql = "SELECT * FROM ".$qTabellenname." WHERE ".$qID_IDENT." = " . $id;
$rs = $db->query( $sql );
if( PEAR::isError( $rs) ) {
print( '<br>'.$rs->getUserInfo().'<br>' );
die();
}
$row = $rs->fetchRow( MDB2_FETCHMODE_ASSOC );

$form = new HTML_Quickform( 'editProfile','post','','','', true );
$form->setDefaults( array( 'kommentar' => $row["Kommentar"] ) );
$attrs = array ( "Rows"=>"4", "Cols"=>"70" );
$form->addElement( 'textarea', 'kommentar', 'Kommentar:', $attrs );
$form->addElement( 'button', 'submit', 'Senden' );
if( $form->validate() ) {
if( isset( $_POST["save"] ) ) {
update();
}
else {
echo '<fieldset><legend>Profil bearbeiten</legend>';
$form->display();
echo '</fieldset>';
}

function update() {
$_POST = disarmInputVars( $_POST );
$qKommentar = $db->quote( $_POST["kommentar"], 'text' );
$strSQL = "UPDATE ".$qTabellenname." SET ".$qKommentar_IDENT. "=" . $qKommentar;
$affected1 = $db->exec( $strSQL );
if( PEAR::isError( $affected1 ) ) {
print( '<br>'.$affected1->getUserInfo().'<br>' );
die();
}
return affected1;
}

Expected result:
----------------
1. set form input data " ' "
2. save form
3. reopen form with saved data: the result is " \'"

[2007-01-24 14:49 UTC] brain dot workDELETEME at gmx dot net

I am sorry!
magic_quotes_gpc was enabled.