When ampersand is used in a text field before_save and after_save mismatched

[servicedeskid]

Issue

I have a relatively simple logic hook that compares a text field and monitors a text field (chase_status) for changes on save.

On changes the logic hook will update two other fields with todays date (last_chased) and the current user full name (last_chased_by). This works well until an ampersand is used anywhere within the text field.

When using an ampersand within this text field and saving the record the logic hooks incorrectly identifies a change and whenever any subsequent saves are performed on the record from this point onwards the date of change field and current user full name field are continually updated even if not changes have been performed to this specific field

We have enabled auditing on this text field and the audit continually records a change even though nothing has changed

This is the logic hook used

if (!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
class ChaseStatusChange
{
	function statusChangeChase($bean, $event, $arguments)
	{
		global $timedate;
		global $current_user;
		if (!empty($bean->fetched_row['id'])) {
			if($bean->chase_status != $bean->fetched_row['chase_status']){
				$bean->last_chased = $timedate->nowDbDate();
				$bean->last_chased_by = $current_user->full_name;
			}
		}
	}
}

Expected Behavior

last_chased and last_chased_by fields should only update when a change to the text field chase_status occurs

Actual Behavior

When a record is saved and the text field contains an ampersand the fields last_chased and last_chased_by are updated even when no changes has been made to the text field chase_status

Possible Fix

When running a query on the audit table I can see that the values for before_value_string and after_value_string do not match when an ampersand is used

On the before_value_string the ampersand is identified as '&' and on the after_value_string its identified as '&' causing the issue.

Context

The bug is causing issues with reporting and business functions relying on accurate reports as we've missed records that have not been "chased" as these records containing an ampersand will have an incorrect last_chased date. Audit data will also be inaccurate showing various users as chasing the record even though they have not actually performed this task.

Your Environment

• SuiteCRM Version used: 7.11.15
• Browser name and version: Microsoft Edge Version 87.0.664.75 (Official build) (64-bit) & Google Chrome Version 87.0.4280.141 (Official Build) (64-bit):
• Environment name and version (MySQL, PHP 7):
• Operating System and version (Windows 10 Pro build 2004)

[johnM2401]

I believe this is due to how SuiteCRM currently decodes/encodes data when going To/From the Database.
For additional information, this appears to be the same issue as logged in:
#8978
#8563

Thanks for raising!

[servicedeskid]

@johnM2401 Thanks for the links to the other submitted issues.

I will modify my code using the suggested workarounds.