Fixed issue #5238: Browse responses in statistics gives SQL error

git-svn-id: file:///Users/Shitiz/Downloads/lssvn/source/limesurvey@10209 b72ed6b6-b9f8-46b5-92b4-906544132732
LimeSurvey · Jun 6, 2011 · 3b29ef6 · 3b29ef6
1 parent 0e74ae6
commit 3b29ef6
Showing 1 changed file with 6 additions and 15 deletions.
diff --git a/admin/browse.php b/admin/browse.php
@@ -121,7 +121,7 @@
     $dateformatdetails=getDateFormatData($_SESSION['dateformat']);
 
     //SHOW HEADER
-    if (!isset($_POST['sql']) || !$_POST['sql']) {$browseoutput .= $surveyoptions;} // Don't show options if coming from tokens script
+    if (!isset($_POST['sql']) || !$_POST['sql']) {$browseoutput .= $surveyoptions;} // Don't show options if coming from tokens/statistics script
     //FIRST LETS GET THE NAMES OF THE QUESTIONS AND MATCH THEM TO THE FIELD NAMES FOR THE DATABASE
 
     $fncount = 0;
@@ -743,31 +743,22 @@
         else
         {
             if ($surveytable['anonymized'] == "N" && db_tables_exist($tokentable))
-                $dtquery = "SELECT * FROM $surveytable LEFT JOIN $tokentable ON $surveytable.token = $tokentable.token ";
+                $dtquery = "SELECT * FROM $surveytable LEFT JOIN $tokentable ON $surveytable.token = $tokentable.token WHERE 1=1 ";
             else
-                $dtquery = "SELECT * FROM $surveytable ";
+                $dtquery = "SELECT * FROM $surveytable WHERE 1=1 ";
             $selectedgroup = returnglobal('selectgroup');
             if (incompleteAnsFilterstate() == "inc")
             {
-                $dtquery .= "submitdate IS NULL ";
+                $dtquery .= " AND submitdate IS NULL ";
 
-                if (stripcslashes($_POST['sql']) !== "")
-                {
-                    $dtquery .= " AND ";
-                }
             }
             elseif (incompleteAnsFilterstate() == "filter")
             {
-                $dtquery .= " submitdate IS NOT NULL ";
-
-                if (stripcslashes($_POST['sql']) !== "")
-                {
-                    $dtquery .= " AND ";
-                }
+                $dtquery .= " AND submitdate IS NOT NULL ";
             }
             if (stripcslashes($_POST['sql']) !== "")
             {
-                $dtquery .= stripcslashes($_POST['sql'])." ";
+                $dtquery .= ' AND '.stripcslashes($_POST['sql'])." ";
             }
             $dtquery .= " ORDER BY {$surveytable}.id";
         }