Note that the full name of this file is:
./includes/classes/db/mysql/query_factory.php
(for people searching for "query_factory.php")
Note that the full name of this file is:
./includes/classes/db/mysql/query_factory.php
(for people searching for "query_factory.php")
Last edited by swguy; 4 Jun 2017 at 12:25 PM.
That Software Guy. My Store: Zen Cart Support
Available for hire - See my ad in Services
Plugin Moderator, Documentation Curator, Chief Cook and Bottle-Washer.
Do you benefit from Zen Cart? Then please support the project.
It would be "really nice" if that function could be updated to log the issue rather than simply displaying it, i.e. changing the 1.5.5a version from:
toCode:function getBindVarValue($value, $type) { $typeArray = explode(':',$type); $type = $typeArray[0]; switch ($type) { case 'csv': return $value; break; case 'passthru': return $value; break; case 'float': return (!zen_not_null($value) || $value=='' || $value == 0) ? 0 : $value; break; case 'integer': return (int)$value; break; case 'string': if (preg_match('/NULL/', $value)) return 'null'; return '\'' . $this->prepare_input($value) . '\''; break; case 'stringIgnoreNull': return '\'' . $this->prepare_input($value) . '\''; break; case 'noquotestring': return $this->prepare_input($value); break; case 'currency': return '\'' . $this->prepare_input($value) . '\''; break; case 'date': if (preg_match('/null/i', $value)) return 'null'; return '\'' . $this->prepare_input($value) . '\''; break; case 'enum': if (isset($typeArray[1])) { $enumArray = explode('|', $typeArray[1]); } return '\'' . $this->prepare_input($value) . '\''; case 'regexp': $searchArray = array('[', ']', '(', ')', '{', '}', '|', '*', '?', '.', '$', '^'); foreach ($searchArray as $searchTerm) { $value = str_replace($searchTerm, '\\' . $searchTerm, $value); } return $this->prepare_input($value); default: die('var-type undefined: ' . $type . '('.$value.')'); } }
Code:function getBindVarValue($value, $type) { $typeArray = explode(':',$type); $type = $typeArray[0]; switch ($type) { case 'csv': return $value; break; case 'passthru': return $value; break; case 'float': return (!zen_not_null($value) || $value=='' || $value == 0) ? 0 : $value; break; case 'integer': return (int)$value; break; case 'string': if (preg_match('/NULL/', $value)) return 'null'; return '\'' . $this->prepare_input($value) . '\''; break; case 'stringIgnoreNull': return '\'' . $this->prepare_input($value) . '\''; break; case 'noquotestring': return $this->prepare_input($value); break; case 'currency': return '\'' . $this->prepare_input($value) . '\''; break; case 'date': if (preg_match('/null/i', $value)) return 'null'; return '\'' . $this->prepare_input($value) . '\''; break; case 'enum': if (isset($typeArray[1])) { $enumArray = explode('|', $typeArray[1]); } return '\'' . $this->prepare_input($value) . '\''; case 'regexp': $searchArray = array('[', ']', '(', ')', '{', '}', '|', '*', '?', '.', '$', '^'); foreach ($searchArray as $searchTerm) { $value = str_replace($searchTerm, '\\' . $searchTerm, $value); } return $this->prepare_input($value); default: trigger_error ("var-type undefined: $type ($value).", E_USER_ERROR); } }
trigger_error - I like how things look so simple !
“Though the problems of the world are increasingly complex, the solutions remain embarrassingly simple.” ― Bill Mollison
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
I had the same issue, upgrading from 1.5.4 to 1.5.5a. Reuploading (or uploading for the first time?) the query_factory file seems to have resolved it.
Note that ./includes/classes/db/mysql/query_factory.php changed from 1.5.5 to 1.5.5a, so if you upgraded but neglected to upgrade this file, or used the 1.5.5 copy, that would cause this problem.
That Software Guy. My Store: Zen Cart Support
Available for hire - See my ad in Services
Plugin Moderator, Documentation Curator, Chief Cook and Bottle-Washer.
Do you benefit from Zen Cart? Then please support the project.
It's possibly uglier? I downloaded 1.5.5a from git-hub,
* @version GIT: $Id: Author: Ian Wilson Modified in v1.6.0 $
which has different definition for 'string' and no definition for 'stringIgnoreNull'
Is it now being taken out of the latest code?
Ouch!
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
This should only happen in situations where there are customizations that have not been brought up to date. Prior to the Trustwave fixes, the array to be passed to $db->perform could be updated like this:
Now it needs to be updated like this:Code:$sql_data_array['tax_id'] = $tax_id; $sql_data_array['tax_exempt'] = $tax_exempt;
Code:$sql_data_array[] = array('fieldName'=>'tax_id', 'value'=>$tax_id, 'type'=>'stringIgnoreNull'); $sql_data_array[] = array('fieldName'=>'tax_exempt', 'value'=>$tax_exempt, 'type'=>'stringIgnoreNull');
That Software Guy. My Store: Zen Cart Support
Available for hire - See my ad in Services
Plugin Moderator, Documentation Curator, Chief Cook and Bottle-Washer.
Do you benefit from Zen Cart? Then please support the project.