$this->db->escape_like_str() wildcard escaping bug #136

Closed
bitbucket-import opened this Issue Aug 19, 2011 · 5 comments

Comments

Projects
None yet
5 participants

== Explanation ==

escape_like_str() does not escape the strings correctly, because there is a bug in escape_str() of database driver.

I have checked MySQL, but the same bugs are probably in all other database drivers.

In escape_str() of database/drivers/mysql/mysql_driver.php,
escaping LIKE condition wildcards is after escaping by mysql_real_escape_string(). But this is the opposite.

The correct escaping order:

escaping LIKE condition wildcards

escaping strings with database escaping api

== Example: ==

strings in database(2 records)

\xxxfoo456

%foo456

If you want to search strings begining with %foo,
{{{

!php

    $orig = '\%foo';
    $string = $this->db->escape_like_str($orig);
    $sql = "SELECT content
            FROM mytable
            WHERE content LIKE '$string%';";

}}}

and it must hit 1 record, but 2 records hit.

If you want to search strings begining with ,
{{{

!php

    $orig = '\\';
    $string = $this->db->escape_like_str($orig);
    $sql = "SELECT content
            FROM mytable
            WHERE content LIKE '$string%';";

}}}

and it must hit 2 records, but 0 record hits.

Test code: https://bitbucket.org/kenjis/cir_test/changeset/d69099543e37

Fix: see attached patch file.

Contributor

kenjis commented Aug 21, 2011

Attachment file has gone!

Please bring back the bitbucket issue system to see attached file and discussion (if any).

Contributor

petsagouris commented Apr 24, 2012

@kenjis Could you send a pull request on github for this?

Contributor

narfbg commented May 24, 2012

This should already be fixed. Can somebody confirm it for MySQL?

Contributor

toopay commented May 24, 2012

@narfbg Seems it still broken, at least from my above test.

narfbg closed this May 24, 2012

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment