adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

[synchronization] Using the ' (aphostrophe) character in filenames/directory names let's sql queries fail #202

New Issue
Closed
opened 2026-10-04 23:47:06 +02:00 by adam · 3 comments
adam commented 2026-10-04 23:47:06 +02:00
Owner
Copy link
Copy source

Reported by RMM on 5 Oct 2012 21:22

When using the ' (aphostrophe, like used in "it's" or "c'est") character in a file or directory name, and tries to exectue the synchronization, it will fail with some sql errors (look below).
Replace the sql queries with prepared statements and it should work. And additionally you will be secured against sql injection attacks...

error message:
Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'an','02 - Xi'an','1','128','3,128,369','true','true','public','10','1.3.10')
,' at line 3

INSERT INTO piwigo_categories
(id,dir,name,site_id,id_uppercat,uppercats,commentable,visible,status,rank,global_rank)
VALUES('369','02 - Xi'an','02 - Xi'an','1','128','3,128,369','true','true','public','10','1.3.10')
, ('370','03 - Hawk's Nest','03 - Hawk's Nest','1','158','3,158,370','true','true','public','5','1.11.5') in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773
Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')
AND status = 'private'' at line 4

SELECT
id
FROM piwigo_categories
WHERE id IN ()
AND status = 'private'
; in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773
Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 203
Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'an/IMG_1908.jpg',NULL,'369','1')
, ('14175','IMG_1909.jpg','IMG 1909','2012-10' at line 3

INSERT INTO piwigo_images
(id,file,name,date_available,path,representative_ext,storage_category_id,added_by)
VALUES('14174','IMG_1908.jpg','IMG 1908','2012-10-05 23:12:35','./galleries/fotos/003 - China/02 - Xi'an/IMG_1908.jpg',NULL,'369','1')
, ('14175','IMG_1909.jpg','IMG 1909','2012-10-05 23:12:35','./galleries/fotos/003 - China/02 - Xi'an/IMG_1909.jpg',NULL,'369','1')
, ('14176','IMG_1910.jpg','IMG 1910','2012-10-05 23:12:35','./galleries/fotos/003 - China/02 - Xi'an/IMG_1910.jpg',NULL,'369','1')
, ('14177','IMG_1913.jpg','IMG 1913','2012-10-05 23:12:35','./galleries/fotos/003 - China/02 - Xi'an/IMG_1913.jpg',NULL,'369','1')
, ('14178','IMG_1915.jpg','IMG 1915','2012-10-05 23:12:35','./galleries/fotos/003 - China/02 - Xi'an/IMG_1915.jpg',NULL,'369',' in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773
Warning: [mysql error 1062] Duplicate entry '14174-369' for key 'PRIMARY'

INSERT INTO piwigo_image_category
(image_id,category_id)
VALUES('14174','369')
, ('14175','369')
, ('14176','369')
, ('14177','369')
, ('14178','369')
, ('14179','369')
, ('14180','369')
, ('14181','369')
, ('14182','369')
, ('14183','369')
, ('14184','369')
, ('14185','369')
, ('14186','369')
, ('14187','369')
, ('14188','369')
, ('14189','369')
, ('14190','369')
, ('14191','369')
, ('14192','369')
, ('14193','369')
, ('14194','369')
, ('14195','369')
, ('14196','369')
, ('14197','369')
, ('14198','369')
, ('14199','369')
, ('14200','369')
, ('14201','369')
, ('14202','369')
, ('14203','369')
, ('14204','369')
, ('14205','369')
, ('14206','369')
, ('14207','369')
, ('14208','369')
, ('14209','369')
, ('14210','369')
, ('14211','369')
, ('14212','369')
, ('14213','369')
, ('14214','370')
, ('14215','370')
, ('14216','370')
, ('14217','370')
, ('14218',' in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773

Piwigo Bugtracker #2762

**Reported by RMM on 5 Oct 2012 21:22** When using the &#039; (aphostrophe, like used in &quot;it&#039;s&quot; or &quot;c&#039;est&quot;) character in a file or directory name, and tries to exectue the synchronization, it will fail with some sql errors (look below). Replace the sql queries with prepared statements and it should work. And additionally you will be secured against sql injection attacks... error message: Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near &#039;an&#039;,&#039;02 - Xi&#039;an&#039;,&#039;1&#039;,&#039;128&#039;,&#039;3,128,369&#039;,&#039;true&#039;,&#039;true&#039;,&#039;public&#039;,&#039;10&#039;,&#039;1.3.10&#039;) ,&#039; at line 3 INSERT INTO piwigo_categories (id,dir,name,site_id,id_uppercat,uppercats,commentable,visible,status,rank,global_rank) VALUES(&#039;369&#039;,&#039;02 - Xi&#039;an&#039;,&#039;02 - Xi&#039;an&#039;,&#039;1&#039;,&#039;128&#039;,&#039;3,128,369&#039;,&#039;true&#039;,&#039;true&#039;,&#039;public&#039;,&#039;10&#039;,&#039;1.3.10&#039;) , (&#039;370&#039;,&#039;03 - Hawk&#039;s Nest&#039;,&#039;03 - Hawk&#039;s Nest&#039;,&#039;1&#039;,&#039;158&#039;,&#039;3,158,370&#039;,&#039;true&#039;,&#039;true&#039;,&#039;public&#039;,&#039;5&#039;,&#039;1.11.5&#039;) in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773 Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near &#039;) AND status = &#039;private&#039;&#039; at line 4 SELECT id FROM piwigo_categories WHERE id IN () AND status = &#039;private&#039; ; in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773 Warning: mysql_fetch_assoc() expects parameter 1 to be resource, boolean given in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 203 Warning: [mysql error 1064] You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near &#039;an/IMG_1908.jpg&#039;,NULL,&#039;369&#039;,&#039;1&#039;) , (&#039;14175&#039;,&#039;IMG_1909.jpg&#039;,&#039;IMG 1909&#039;,&#039;2012-10&#039; at line 3 INSERT INTO piwigo_images (id,file,name,date_available,path,representative_ext,storage_category_id,added_by) VALUES(&#039;14174&#039;,&#039;IMG_1908.jpg&#039;,&#039;IMG 1908&#039;,&#039;2012-10-05 23:12:35&#039;,&#039;./galleries/fotos/003 - China/02 - Xi&#039;an/IMG_1908.jpg&#039;,NULL,&#039;369&#039;,&#039;1&#039;) , (&#039;14175&#039;,&#039;IMG_1909.jpg&#039;,&#039;IMG 1909&#039;,&#039;2012-10-05 23:12:35&#039;,&#039;./galleries/fotos/003 - China/02 - Xi&#039;an/IMG_1909.jpg&#039;,NULL,&#039;369&#039;,&#039;1&#039;) , (&#039;14176&#039;,&#039;IMG_1910.jpg&#039;,&#039;IMG 1910&#039;,&#039;2012-10-05 23:12:35&#039;,&#039;./galleries/fotos/003 - China/02 - Xi&#039;an/IMG_1910.jpg&#039;,NULL,&#039;369&#039;,&#039;1&#039;) , (&#039;14177&#039;,&#039;IMG_1913.jpg&#039;,&#039;IMG 1913&#039;,&#039;2012-10-05 23:12:35&#039;,&#039;./galleries/fotos/003 - China/02 - Xi&#039;an/IMG_1913.jpg&#039;,NULL,&#039;369&#039;,&#039;1&#039;) , (&#039;14178&#039;,&#039;IMG_1915.jpg&#039;,&#039;IMG 1915&#039;,&#039;2012-10-05 23:12:35&#039;,&#039;./galleries/fotos/003 - China/02 - Xi&#039;an/IMG_1915.jpg&#039;,NULL,&#039;369&#039;,&#039; in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773 Warning: [mysql error 1062] Duplicate entry &#039;14174-369&#039; for key &#039;PRIMARY&#039; INSERT INTO piwigo_image_category (image_id,category_id) VALUES(&#039;14174&#039;,&#039;369&#039;) , (&#039;14175&#039;,&#039;369&#039;) , (&#039;14176&#039;,&#039;369&#039;) , (&#039;14177&#039;,&#039;369&#039;) , (&#039;14178&#039;,&#039;369&#039;) , (&#039;14179&#039;,&#039;369&#039;) , (&#039;14180&#039;,&#039;369&#039;) , (&#039;14181&#039;,&#039;369&#039;) , (&#039;14182&#039;,&#039;369&#039;) , (&#039;14183&#039;,&#039;369&#039;) , (&#039;14184&#039;,&#039;369&#039;) , (&#039;14185&#039;,&#039;369&#039;) , (&#039;14186&#039;,&#039;369&#039;) , (&#039;14187&#039;,&#039;369&#039;) , (&#039;14188&#039;,&#039;369&#039;) , (&#039;14189&#039;,&#039;369&#039;) , (&#039;14190&#039;,&#039;369&#039;) , (&#039;14191&#039;,&#039;369&#039;) , (&#039;14192&#039;,&#039;369&#039;) , (&#039;14193&#039;,&#039;369&#039;) , (&#039;14194&#039;,&#039;369&#039;) , (&#039;14195&#039;,&#039;369&#039;) , (&#039;14196&#039;,&#039;369&#039;) , (&#039;14197&#039;,&#039;369&#039;) , (&#039;14198&#039;,&#039;369&#039;) , (&#039;14199&#039;,&#039;369&#039;) , (&#039;14200&#039;,&#039;369&#039;) , (&#039;14201&#039;,&#039;369&#039;) , (&#039;14202&#039;,&#039;369&#039;) , (&#039;14203&#039;,&#039;369&#039;) , (&#039;14204&#039;,&#039;369&#039;) , (&#039;14205&#039;,&#039;369&#039;) , (&#039;14206&#039;,&#039;369&#039;) , (&#039;14207&#039;,&#039;369&#039;) , (&#039;14208&#039;,&#039;369&#039;) , (&#039;14209&#039;,&#039;369&#039;) , (&#039;14210&#039;,&#039;369&#039;) , (&#039;14211&#039;,&#039;369&#039;) , (&#039;14212&#039;,&#039;369&#039;) , (&#039;14213&#039;,&#039;369&#039;) , (&#039;14214&#039;,&#039;370&#039;) , (&#039;14215&#039;,&#039;370&#039;) , (&#039;14216&#039;,&#039;370&#039;) , (&#039;14217&#039;,&#039;370&#039;) , (&#039;14218&#039;,&#039; in /var/www/gallery/include/dblayer/functions_mysql.inc.php on line 773 [Piwigo Bugtracker #2762](http://piwigo.org/bugs/view.php?id=2762) <!-- github-sync-id:97226461 -->
adam closed this issue 2026-10-04 23:47:06 +02:00
adam commented 2026-10-04 23:47:07 +02:00
Author
Owner
Copy link
Copy source

Comment posted by RMM on 9 Oct 2012 21:07

Attached a patch which solves the problem...
Also patched an other funcion which has the potencial same bug.

**Comment posted by RMM on 9 Oct 2012 21:07** Attached a patch which solves the problem... Also patched an other funcion which has the potencial same bug. <!-- github-comment-id:124892867 -->
adam commented 2026-10-04 23:47:08 +02:00
Author
Owner
Copy link
Copy source

Comment posted by RMM on 9 Oct 2012 22:32

there are still some problems.. seems like people love to create unescaped dynamic queries..
new patch also solves this problem in i.php and additionally I found some other places where similar problems could occur...

**Comment posted by RMM on 9 Oct 2012 22:32** there are still some problems.. seems like people love to create unescaped dynamic queries.. new patch also solves this problem in i.php and additionally I found some other places where similar problems could occur... <!-- github-comment-id:124892882 -->
adam commented 2026-10-04 23:47:09 +02:00
Author
Owner
Copy link
Copy source

See #250

See #250 <!-- github-comment-id:519910026 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#202