Quotes have issues affecting my product images [NOTE: magic_quotes_sybase issue]

[DrByte]

Yes, I did notice.
I'm continuing discussion in this thread, because it contains relevant history, rather than a new post.

Using the very same product name and description as yourself, I cannot reproduce the problem on my own test servers (one of them using PHP v4.4.5 and MySQL 4.2.11-standard-log ... which makes configuration very similar to yours).

Your server's addslashes() function appears to be converting single-quotes to two single-quotes instead of a backslash and a single-quote.

There is a growing trend towards using '' instead of \' (considered to be "more portable" across database-engine choices, and safer in multi-byte server configurations), but that usually only happens by using the database-provided scripts for escaping content being prepared for insertion into the database.

I've been researching to find out whether/where addslashes() has been altered to produce '' instead of \' but haven't found it.

Hence the question about your PHP version.

[DrByte]

Can you upload the techsupp.php file (you can find it in the zc_install folder of your Zen Cart files) to your server? (into your "cart" folder is fine), and post a link to it?

Specifically, I want to look at your magic_quotes settings for _runtime and _sybase.

Apparently having magic_quotes_sybase enabled will cause the use of single-quotes for escaping instead of backslashes.

[HDG]

Here is the link:
http://www.aaau.com/cart/techsupp.php

Strangely though, it gives me a 500 Internal Server Error and I'm not sure why. The logs mention nothing.

[HDG]

Nevermind, found the logs.

[11-Jun-2007 14:48:21] PHP Warning:  session_start(): Cannot send session cookie - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:21] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:21] PHP Warning:  Cannot modify header information - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/init_includes/init_templates.php on line 78
[11-Jun-2007 14:48:29] PHP Warning:  session_start(): Cannot send session cookie - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:29] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:29] PHP Warning:  Cannot modify header information - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/init_includes/init_templates.php on line 78

[DrByte]

The 500 error is probably some mod-security issue.

Try this:
- recreate the zc_install folder
- upload the zc_install/.htaccess file
- upload the zc_install/techsupp.php file

The .htaccess should work around the mod_security bit, and using the subfolder keeps the effect isolated to the zc_install folder.

[HDG]

http://www.aaau.com/cart/zc_install/techsupp.php

Still getting the same error. And yes, .htaccess is uploaded.

[DrByte]

Puzzling.

Alternate approach...
Login into your admin
Choose Tools->Server Info

Search down the screen for magic_quotes and post what you find for the different variations.

[HDG]

(First on/off is Local, second is Master)
magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase On On

[DrByte]

(First on/off is Local, second is Master)
magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase On On

Hmmm ... as I suspected.

If magic_quotes_sybase is on, a single-quote is escaped with a single-quote instead of a backslash if magic_quotes_gpc or magic_quotes_runtime are enabled.

Now to come up with a workaround for you ...

[HDG]

I have access to change those, but I don't think I should. We have many clients on the server, some of which are not mine.

mysql_real_escape_string() wouldn't solve this, would it?