I believe there's a bug in the state model's getStateByCode() function. The $code variable is being treated as an int in the query:
$query = 'SELECT * FROM `#__virtuemart_states` WHERE `' . $stateCodeFieldname . '` = ' (int)$code;
If I understand the function properly, the code should be treated as a 2 or 3 character string.
Interesting,. on the other side, this code is never called. So I just deleted it. I think it was done while we add the security stuff in the summer. Thx
Gotcha. It was almost identical to getStateIDByName() in shopfunctions.