Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MySQLi Class Modifies SQL statement after incorrectly assuming it is creating a table #652

Closed
eSilverStrike opened this issue Jan 18, 2016 · 3 comments
Assignees
Labels
Bug An issue describing unexpected or malicious behaviour.
Milestone

Comments

@eSilverStrike
Copy link
Member

Was running an import for a plugin and the sql statement below kept failing because "ENGINE=MyISAM DEFAULT CHARSET=utf8" was kept being added at the end of the statement by Geeklogs database class. Looking at the code it looks like in the mysqli.class.php the function dbQuery at line 244 checks to see if it is a create table statement. If it is it then adds the engine info. The problem is that the select statement is not a create table. (it just happens to have those words)
Create Table should exist at the start of the sql statement if not then it is not creating a table and the extra info should not be added.

Should check MySQL.class.php for this bug as well

REPLACE INTO comments (sid,uid,comment,date,title,pid,lft,rht,indent,type,ipaddress,name) VALUES ('50',12279,'This will not form the necessary sql tables what is wrong ?
Sun 17 Sep 09:22:19 2006 - Attempting to install the Journal Plugin
Sun 17 Sep 09:22:19 2006 - Attempting to create table journal for Journal plugin
Sun 17 Sep 09:22:19 2006 - 1067: Invalid default value for jrn_id. SQL in question:

any help gladly recieved<div class="comment-sig">---
One of the Geeklog Core Developers

',now(),'Form wouldn\'t post',15047,6,7,1,'downloads','82.195.106.119','') ENGINE=MyISAM DEFAULT CHARSET=utf8
@eSilverStrike eSilverStrike added the Bug An issue describing unexpected or malicious behaviour. label Jan 18, 2016
@eSilverStrike eSilverStrike added this to the 2.1.2 milestone Jan 18, 2016
@mystralkk
Copy link
Member

What will happen if you change the line 244 from

        if (preg_match('/create\s+table\s/i', $sql)) {

to

        if (preg_match('/^create\s+table\s/i', $sql)) {

?

@eSilverStrike
Copy link
Member Author

I would think it should work.

mystralkk added a commit that referenced this issue Jan 19, 2016
…er incorrectly assuming it is creating a table (issue #652).
@mystralkk
Copy link
Member

Fixed with changeset dec6623.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug An issue describing unexpected or malicious behaviour.
Projects
None yet
Development

No branches or pull requests

2 participants