VirtueMart Forum

VirtueMart 2 + 3 + 4 => Virtuemart Development and bug reports => Topic started by: Studio 42 on June 13, 2016, 14:49:08 PM

Title: Vm 3.0.16 getNeighborProducts mysql error with quote
Post by: Studio 42 on June 13, 2016, 14:49:08 PM
Quote1064 - You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'asimon"), 1953, UNC" ORDER BY product_name DESC, `virtuemart_product_id` DESC L' at line 1 SQL=SELECT p.`virtuemart_product_id`, `l`.`product_name`,`l`.product_name FROM `#__virtuemart_products` as p INNER JOIN `#__virtuemart_products_en_gb` as l using (`virtuemart_product_id`) LEFT JOIN `#__virtuemart_product_shoppergroups` as ps ON p.`virtuemart_product_id` = `ps`.`virtuemart_product_id` LEFT JOIN `#__virtuemart_product_categories` as pc ON p.`virtuemart_product_id` = `pc`.`virtuemart_product_id` WHERE ( `pc`.`virtuemart_category_id` = 3 AND ( `ps`.`virtuemart_shoppergroup_id`= "1" OR `ps`.`virtuemart_shoppergroup_id` IS NULL ) AND p.`published`="1" ) AND p.`virtuemart_product_id`!="22" AND `l`.product_name <= "Israel: telephone token ("asimon"), 1953, UNC" ORDER BY product_name DESC, `virtuemart_product_id` DESC LIMIT 1
I think you know the problem. $db->quote .... missing
note : This was not the case in VM2.x
Title: Re: Vm 3.0.16 getNeighborProducts mysql error with quote
Post by: Studio 42 on June 13, 2016, 14:55:34 PM
I use this in vm3.0.16:
change line 1670:
$qm = $alreadyFound.' AND '.$whereorderByName.' '.$op.' "'.$orderByValue.'"  ORDER BY '.$orderByName.' LIMIT 1';

to

$qm = $alreadyFound.' AND '.$whereorderByName.' '.$op.' '.$db->quote($orderByValue).'  ORDER BY '.$orderByName.' LIMIT 1';
Title: Re: Vm 3.0.16 getNeighborProducts mysql error with quote
Post by: Milbo on June 16, 2016, 12:51:12 PM
thank you. I add it directly
Title: Re: Vm 3.0.16 getNeighborProducts mysql error with quote
Post by: Milbo on July 19, 2016, 19:15:53 PM
Please use next time directly escape, instead of quote. We dont need it, because we use ' for the sql String and " for the text, so it is already quoted.