Dynamic Filter [Support Thread]

[Design75]

Thank you for confirming that.

I think the error is getting from the following file at around line 54, I am trying to make sense out of it.

Basically what happens is that the single and double are entered in to the query, and thus causing errors. We need to figure a way to tell the script to add an escape to certain characters before adding them to the query.
It shouldn't be that difficult, but my skills are still limited, and am learning on the way :)

[Kevin205]

but my skills are still limited, and am learning on the way :)

Same here.

I tried escaping the " and or '. No luck.

The only thing that does not produce an error, is the following format:

1& #39;-2& #34; x 1& #39;-2& #34;

But try to tell a shop owner to look at the following and do your additions, deletions, edits and audits and etc.

5&# 39;-7& #34; x 3& #39;-11& #34;
1& #39;-2& #34; x 1& #39;-2& #34;
12& #39;-4& #34; x 6& #39;-6& #34;
1&# 39;-2& #34; x 1& #39;-2& #34;
2&# 39;-9& #34; x 5& #39;-3& #34;
.
.
.

How is that for head spin?

I am trying to figure out a way also.

Thanks.




ps. Spaces between & and # are left out, so it displays here.

[Design75]

Same here.

I tried escaping the " and or '. No luck.

The only thing that does not produce an error, is the following format:


But try to tell a shop owner to look at the following and do your additions, deletions, edits and audits and etc.


How is that for head spin?

I am trying to figure out a way also.

Thanks.




ps. Spaces between & and # are left out, so it displays here.

Here's a quick solution,

find in includes/modules/YUOR_TEMPLATE/dynamic_filter.php

          $having .= ' FIND_IN_SET("' . $key . $value . '", GROUP_CONCAT(CONCAT(REPLACE(po.products_options_name, " ", ""), pov.products_options_values_name)))'; 

replace with:

          $value = preg_replace('/"/','\\"',$value);
          $value = preg_replace('/&acute/','\\&acute',$value);
          $having .= ' FIND_IN_SET("' . $key . $value . '", GROUP_CONCAT(CONCAT(REPLACE(po.products_options_name, " ", ""), pov.products_options_values_name)))'; 

more values can be added if needed

[Kevin205]

I will test your solution in my environment.

And this is what I came up with. It seems to be working for all attributes.
before

          }
          $having .= ' FIND_IN_SET("' . $key . $value . '", GROUP_CONCAT(CONCAT(REPLACE(po.products_options_name, " ", ""), pov.products_options_values_name)))';
          $filter_attr = true;
          $prvHaving = $key;
        }
      }
    }
  }
  if($filter != '') $filter .= ')'; 

After

          }
$var1 = addslashes($value);
          $having .= ' FIND_IN_SET("' . $key . $var1 . '", GROUP_CONCAT(CONCAT(REPLACE(po.products_options_name, " ", ""), pov.products_options_values_name)))';
          $filter_attr = true;
          $prvHaving = $key;
        }
      }
    }
  }
  if($filter != '') $filter .= ')'; 

What do you think?

I don't know whether it will have issues later on!

[Design75]

Very nice !

but it can be written as:

          $having .= ' FIND_IN_SET("' . $key . addslashes($value) . '", GROUP_CONCAT(CONCAT(REPLACE(po.products_options_name, " ", ""), pov.products_options_values_name)))'; 

[Kevin205]

Which one would you use, yours solution or mine?

I really appreciate your help on this.

[Design75]

Which one would you use, yours solution or mine?

I really appreciate your help on this.

Yours, with my improvement (see previous post)

[simon1066]

Very nice !

but it can be written as:

          $having .= ' FIND_IN_SET("' . $key . addslashes($value) . '", GROUP_CONCAT(CONCAT(REPLACE(po.products_options_name, " ", ""), pov.products_options_values_name)))'; 

Do you think you could explain how this works, which special characters does it escape? Looks like it might be just ["]. If so how would I amend the code to escape other characters? (I have html code in products_options_values_name so there may be more characters to address)

I'm also having trouble getting products to display when characters such as comma and decimal point are in products_options_values_name (no html code in these)

How would I amend the code to convert, I guess

, to & #44;
. to & #46;
(spaces added after &)

Thanks

[simon1066]

Whilst looking at this further it seems that although there was definitely an issue with using a comma, the no show of some products may be related to the number of characters in products_options_values_name.

It all seems a bit odd, so I'm off to check that file merging was done properly