UBB.threads PHP Forum Software Community Forums UBB.threads Bug Reports Fixed Bugs [Fixed 7.3][7.2] database info query does not escape special characters

Control panel > database tools > info

/admin/dbinfo.php

This query does not escape special characters, like the underscore.

I have both an ubbtest_ and ubbt_, and if I do a database info on the ubbt_ setup, I also get all ubbtest_ tables. Escaping the underscore with an \ would do the trick.

Not really a biggy I guess

Thanks for the info. Already have 7.2.2 packaged up, but I'll make a note on this to get it fixed for the next release.

In case your waiting for my permission, it's ok to but in the members area

using LIKE is not the way to go either, because there is no guarantee of _ after each prefix... yes, i always DO use _, but it's not forced upon the admin at setup..

assume there are two db's 'ubbt' and 'ubbtest' (no underscore)..

the like will match both too if the query did "like ubbt%"

best way is to do an equality check on the actual prefix including the length..

ie:


this should also handle the _ problem you had.. assumes latin1 charset (you may have different)

2c

I know it's not guaranteed. But doesn't escaping the _ with a \ make sure you test for ubbt_ instead of ubbt?. Don't see why like can't do the trick we want.


well, it definatly saves adding code to escape the _.

sure it will, if we assume _ is forced.. i will cede that point.

now some poor bastard is gonna leave an _ out and he won't get what he expects..

it only affects that one line, so i was suggesting how to handle all cases..

i would be interested if that query handles the _ for you though.. without escaping the _ .. because i have the exact same setup .. (ubbt_ and ubbtmuhaha_) and it works ...

so all i can see is that we have two diff charsets for the db? or diff version of mysql ? (i have latin1, mysql5) and DON'T have to escape the _ ..

hehe postscript.. a user can still screw themselves if the WANT.. but i wouldn't worry too much about it either.. ie: ubbt_ and ubbt_new_

so we are splitting hairs to an extent, but i like to go 'geek' every so often

Don't need to asume that. Just a need to escape the _ in the prefix, if it's used. And the % is someone is smart enough to use that.

Gonna test the alternative query now.

Edit: Your alternatives is A okay here also.

thanks blaask for trying that. the reason i was wondering is because we use _ everywhere and i don't see why it makes a diff in THIS case..

only thing (and i'd have to look it up) is that 'LIKE' somehow doesn't care about them?

dunno

lol i just read your reply...

i guess _ and LIKE are causing it.. i'll check mysql manual on that..

mssql doesn't care, i know..

Don't need to guess, the _ is causing it.

In like, the % is like the * and the _ is like the ?.

Hmm, this made more sense typing it then reading it back

aha!

that is the single character wildcard

whoops.. you beat me to the punch again.. oh, well now we know the WHY and the HOW TO fix anyway...

cheers..

I think there are countries where you would be locked away for saying any of these 2 things

Yarp's implementation is now in 7.3