User Tracking mySQL error

[gcceric]

I"ve installed User Tracking 1.3.6.1. The mysql script installs fine (from Zen or PHPMyadmin) but then I'm getting this error on my home page:

1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '12.178.30.2')' at line 1
in:
[insert into user_tracking (customer_id, full_name, session_id, ip_address, time_entry, time_last_click, last_page_url, referer_url, page_desc, customers_host_address) values ('0', 'Guest', '49598118178dab75856fbee99b07633e', '12.178.30.2', '1187824599', '1187824599', '/', 'http://www.google.com/ig?hl=en', '

I've read through the 31 page thread in this forum (panting-out of breath), but have not been able to solve it.

Any help would be appreciated- ERIC

BTW- my mysql knowledge is (ahem) underwhelming!

[goster]

The problem lies in the file user_tracking.php located /includes/functions/extra_functions/

First there are 2 user_tracking.php files so make sure you're looking at the correct one.

Look at line 69, I would consider this a bug. referer_url is attempting to place values in the database without checking for properly formatted input, in your particular case you referer_url had some html tags which was corrupting your insert. This is a security hole. I've remedied this by adding the addslashes function. Replace your insert with the following:

$db->Execute("insert into " . TABLE_USER_TRACKING . " (customer_id, full_name, session_id, ip_address, time_entry, time_last_click, last_page_url, referer_url, page_desc, customers_host_address) values ('" . $cust_id . "', '" . addslashes($wo_full_name) . "', '" . $wo_session_id . "', '" . $wo_ip_address . "', '" . $current_time . "', '" . $current_time . "', '" . addslashes($wo_last_page_url) . "', '" . addslashes($referer_url) . "', '" . addslashes($page_desc) . "', '" . addslashes($customers_host_address) . "')");

[gcceric]

Yes - that worked- thanks. I hadn't been able to get that module working for quite awhile! ERIC