Ticket #2434 (closed defect: fixed)

Opened 3 years ago

Last modified 2 years ago

Linked Image + Apostrophe In Post = Database Error

Reported by: Dave-Millercom Assigned to: dougal
Priority: high Milestone:
Component: Administration Version: 2.0.1
Severity: major Keywords: image, link, database, apostrophe, attachments, sql, mysql, has-patch, needs-testing
Cc:

Description

If a new post contains both an image either "Linked To Image" or "Linked To Page" and an apostrophe anywhere in the post (') then the apostrophe is not escaped properly causing a database error.

Here's the HTML code version of a post: 

<p>' <a title="Tim &amp; Tom Just Arrived" onclick="doPopup(7);return false;" class="imagelink" rel="attachment" id="p7" href="http://www.dave-miller.com//?attachment_id=7"><img width="120" height="96" alt="Tim &amp; Tom Just Arrived" id="image7" src="http://www.dave-miller.com/wp-uploads/2006/02/Photo-0335.thumbnail.jpg" /></a></p>

And the error when I clicked Save & Continue Editing - notice the ' is not escaped in post_content: 

WordPress database error: [You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'title="Tim & Tom Just Arrived" class="imagelink" rel="attachmen]

UPDATE IGNORE wp_posts SET
post_author = '1',
post_date = '0000-00-00 00:00:00',
post_date_gmt = '0000-00-00 00:00:00',
post_content = '' <a title="Tim & Tom Just Arrived" class="imagelink" rel="attachment" id="p7" onclick="doPopup(7);return false;" href="http://www.dave-miller.com/?attachment_id=7"><img width="120" height="96" alt="Tim & Tom Just Arrived" id="image7" src="http://www.dave-miller.com/wp-uploads/2006/02/Photo-0335.thumbnail.jpg" /></a>',
post_content_filtered = '',
post_title = 'Test',
post_excerpt = '',
post_status = 'draft',
comment_status = 'open',
ping_status = 'open',
post_password = '',
post_name = '',
to_ping = '',
pinged = '',
post_modified = '2006-02-12 19:14:38',
post_modified_gmt = '2006-02-12 19:14:38',
post_parent = '0',
menu_order = '0'
WHERE ID = 15

Warning: Cannot modify header information - headers already sent by (output started at /home/.../wp-includes/wp-db.php:102) in /home/.../wp-admin/post.php on line 122

Attachments

admin-functions.php.diff (357 bytes) - added by Dave-Millercom on 02/13/06 21:18:13.
Patch
attachment-fix.diff (0.7 kB) - added by dougal on 02/16/06 20:55:53.
Fixes escaping problem which occurs in posts with attachments.

Change History

02/12/06 19:53:54 changed by Dave-Millercom

Some info I forgot to add:

PHP 4.3.11, magic quotes & runtime off (also tried them on and got a different error) MySQL 4.0.25-standard

02/13/06 21:18:13 changed by Dave-Millercom

  • attachment admin-functions.php.diff added.

Patch

02/13/06 21:24:35 changed by Dave-Millercom

I finally figured out the problem was:

In admin-function.php > fix_attachment_links(), when wp_update_post($post) was called, the post contents had no slashes added, unlike in edit_post() (which calls wp_update_post($_POST)).

I added a patch for this. I hope it's in the right format - I've never made one before.

Dave

02/13/06 21:26:43 changed by Dave-Millercom

Also I can't promise it doesn't have any side effects because I haven't extensively tested it. If it does, it might be better to make a copy of $post and add slashes to that instead.

02/16/06 20:54:49 changed by dougal

  • keywords changed from image,link,database,apostrophe to image, link, database, apostrophe, attachments, sql, mysql.
  • owner changed from anonymous to dougal.
  • priority changed from normal to high.

I spent the last week trying to track down this same problem, and finally came to the same conclusion you did (see my thread on wp-testers).

I came up with a similar patch, but used the WP function addslashes_gpc(), which automagically handles the server's magic_quotes_gpc setting. I also added a conditional to add some protection against mangled attachment IDs.

02/16/06 20:55:53 changed by dougal

  • attachment attachment-fix.diff added.

Fixes escaping problem which occurs in posts with attachments.

02/16/06 21:02:46 changed by dougal

  • keywords changed from image, link, database, apostrophe, attachments, sql, mysql to image, link, database, apostrophe, attachments, sql, mysql, has-patch, needs-testing.

Okay, I've attached my patch (attachment-fix.diff). Somebody please review, and if there are no objections, I'll commit it to trunk and to the 2.0 branch.

02/16/06 21:07:04 changed by dougal

  • status changed from new to assigned.

02/19/06 10:44:16 changed by ryan

  • milestone set to 2.0.2.

You can get_post() as ARRAY_A and then add_magic_quotes() on the entire array before sending to wp_update_post(). We need to do that before both calls to wp_update_post(). Don't use magic_quotes_gpc() since the post data is coming from the DB, not from GPC. The post data will always be unescaped when being pulled straight from the DB.

03/02/06 02:48:12 changed by ryan

[3586] for trunk.

03/02/06 02:49:21 changed by ryan

[3587] for 2.0 branch.

03/04/06 22:05:01 changed by ryan

Need confirmation for 2.0.2.

03/04/06 22:40:43 changed by skeltoac

wfm

03/04/06 22:42:59 changed by ryan

  • status changed from assigned to closed.
  • resolution set to fixed.

11/30/06 19:41:50 changed by

  • milestone deleted.

Milestone 2.0.2 deleted