VM 2.0.26d (clean install with demo data)
J! 2.5.17
On my production site I have many products with names ending in " (double quote, the abbreviation for inch).
I have 'Show product navigation?' turned on.
EDIT: Problem occurs if there is double quote anywhere within the product name
EDIT 2: Problem introduced in product model in VM2.0.25 when function getNeighborProducts was redesigned. I think special characters in the query need to be escaped and I have a work round in http://forum.virtuemart.net/index.php?topic=121530.msg414827#msg414827 (http://forum.virtuemart.net/index.php?topic=121530.msg414827#msg414827)
Suppose I have Product A, Product B" and Product C as neighbours in that order
On Product B" the neighbor product links do not show. On the neighbour prducts (Product A and Product C) the links to Product B"are shown correctly.
The attached screenshots show the problem on a demo site http://vm226d.cloudaccess.net/shop/gardentools.html (http://vm226d.cloudaccess.net/shop/gardentools.html) where I have renamed one of the demo products from Shovel to Shovel 12"
The neigbour products in Garden Tools category are Plastic Ladder, Shovel 12", Smaller Shovel
Screenshot01 shows the five prodcts in Garden Tools category with the renamed Shovel 12"
Screenshot02 shows the correct product navigation on the Plastic Ladder details page
Screenshot03 shows the missing navigation on the Shovel 12" details page
Screenshot04 shows the correct product navigation on the Smaller Shovel details page
[attachment cleanup by admin]
I have a workaround:
If a single quote ' is used at the end of a product name there is no problem in the neighbour product links - so I can use two single quotes '' instead of a double quote "
I have a solution...
Administrator | Components | com_virtuemart | Models | product.php
I think special characters in the query need to be escaped.
I am not sure of the best place within the code to do this but the following seems to work.
In function getNeighborProducts at line 1487
Change
$qm = ' AND '.$orderByName.' '.$op.' "'.$orderByValue.'" ORDER BY '.$orderByName.' '.$direction.' LIMIT 1';
to
$qm = ' AND '.$orderByName.' '.$op.' "'.addslashes($orderByValue).'" ORDER BY '.$orderByName.' '.$direction.' LIMIT 1';
I am not sure if other fields within the query should also be treated this way - perhaps Milbo could confirm?
EDIT: Should getEscaped be used rather than addslashes?
$qm = ' AND '.$orderByName.' '.$op.' "'. $db->getEscaped($orderByValue).'" ORDER BY '.$orderByName.' '.$direction.' LIMIT 1';
The problem still persists in VM3. Dev team, could you please make this quick fix to avoid hacking of core files?
ehrm, it works for me. Maybe the difference is that I use the superadmin to store it. Please check your ACL, in special of the first vm tab.