I am using Zen Cart 1.3.8a. (Fresh install.) So far it's been great. But I did find a bug...
I sell signed merchandise in my store, so I use a lot of text boxes for added messages.
However, if an ' (apostrophe) is used in the text box, upon adding the item to the shopping cart, my database flips out and locks me out of the site. Until I clear my cache, close my browser window, then reopen and go back to the site.
I get this error:
1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHATEVER MESSAGE WAS ADDED WTH AN APOSTROPHE";}s:10:"attributes";a:1:{i:4;s:1:"0";}}}', cart_total = '5',' at line 1
in:
[UPDATE zen_supertracker SET last_click = NOW(), exit_page='/eStore/index.php?main_page=shopping_cart&number_of_uploads=0', exit_page_name='The Shopping Cart', num_clicks=num_clicks+1, added_cart='true', categories_viewed='a:1:{i:12;i:1;}', products_viewed='*25?*5?', customer_id='0', completed_purchase='false', cart_contents='a:1:{s:34:"5:813e40b3c63ea9407afa07ec0fe8d562";a:3:{s:3:"qty";d:1 ;s:17:"attributes_values";a:1:{i:4;s:36:"Use an ' and the database flips out!";}s:10:"attributes";a:1:{i:4;s:1:"0";}}}', cart_total = '5', order_id = '0' WHERE tracking_id='2316']
I do have Supertracker installed; no problems with it, but I don't know if it has anything to do with the database error or not.
If you backslash the apostrophe when you type it in the textbox, there are no problems.
Here's a sample page
- and you will see where I had to add the comment about backslashing:
Any help would be much appreciated.
Thanks, Kim



