fix tag quote issues

functions.php

@@ -925,13 +925,9 @@ function update_rss_feed($link, $feed_url, $feed, $ignore_daemon = false) {
 
 						foreach ($entry_tags as $tag) {
 
-							$tag = mb_strtolower($tag, 'utf-8');
+							$tag = sanitize_tag($tag);
 							$tag = db_escape_string($tag);
 
-							$tag = str_replace("+", " ", $tag);	
-							$tag = str_replace("\"", "", $tag);	
-							$tag = str_replace("technorati tag: ", "", $tag);
-
 							if (!tag_is_valid($tag)) continue;
 
 							$result = db_query($link, "SELECT id FROM ttrss_tags		
@@ -942,8 +938,6 @@ function update_rss_feed($link, $feed_url, $feed, $ignore_daemon = false) {
 
 							if ($result && db_num_rows($result) == 0) {
 
-	//							print "tagging $entry_id as $tag<br>";
-
 								db_query($link, "INSERT INTO ttrss_tags 
 									(owner_uid,tag_name,post_int_id)
 									VALUES ('$owner_uid','$tag', '$entry_int_id')");
@@ -3561,8 +3555,10 @@ function outputArticleXML($link, $id, $feed_id, $mark_as_read = true) {
 
 			while ($tmp_line = db_fetch_assoc($tmp_result)) {
 				$num_tags++;
-				$tag = $tmp_line["tag_name"];				
-				$tag_str = "<a href=\"javascript:viewfeed('$tag')\">$tag</a>, "; 
+				$tag = $tmp_line["tag_name"];
+				$tag_escaped = str_replace("'", "\\'", $tag);
+
+				$tag_str = "<a href=\"javascript:viewfeed('$tag_escaped')\">$tag</a>, ";
 
 				if ($num_tags == 6) {
 					$tags_str .= "<a href=\"javascript:showBlockElement('allEntryTags')\">...</a>";
@@ -3988,4 +3984,15 @@ function print_checkpoint($n, $s) {
 		echo sprintf("<!-- CP[$n] %.4f seconds -->", $ts - $s);
 		return $ts;
 	}
+
+	function sanitize_tag($tag) {
+		$tag = trim($tag);
+
+		$tag = mb_strtolower($tag, 'utf-8');
+
+		$tag = str_replace("+", " ", $tag);	
+		$tag = str_replace("technorati tag: ", "", $tag);
+
+		return $tag;
+	}
 ?>

modules/backend-rpc.php

@@ -202,7 +202,9 @@ function handle_rpc_request($link) {
 		}
 
 		if ($subop == "setArticleTags") {
+
 			$id = db_escape_string($_GET["id"]);
+
 			$tags_str = db_escape_string($_GET["tags_str"]);
 
 			$tags = array_unique(trim_array(split(",", $tags_str)));
@@ -220,7 +222,7 @@ function handle_rpc_request($link) {
 					post_int_id = $int_id AND owner_uid = '".$_SESSION["uid"]."'");
 
 				foreach ($tags as $tag) {
-					$tag = trim($tag);
+					$tag = sanitize_tag($tag);	
 
 					if (!tag_is_valid($tag)) {
 						continue;
@@ -229,6 +231,8 @@ function handle_rpc_request($link) {
 					if (preg_match("/^[0-9]*$/", $tag)) {
 						continue;
 					}
+
+//					print "<!-- $tag -->";
 
 					if ($tag != '') {
 						db_query($link, "INSERT INTO ttrss_tags 

viewfeed.js

@@ -727,7 +727,11 @@ function editTagsSave() {
 
 	var query = Form.serialize("tag_edit_form");
 
-	xmlhttp_rpc.open("GET", "backend.php?op=rpc&subop=setArticleTags&" + query, true);			
+	query = "backend.php?op=rpc&subop=setArticleTags&" + query;
+
+	debug(query);
+
+	xmlhttp_rpc.open("GET", query, true);			
 	xmlhttp_rpc.onreadystatechange=tag_saved_callback;
 	xmlhttp_rpc.send(null);