SQL error when sending newsletter to emails with '

[peeceelee]

Have an email that has an apostrophe in it...and when sending newsletters, I get the following error (i've edited the actual domain of the email address):


1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '[email protected]'' at line 1
in:
[select customers_email_format from customers where customers_email_address= 'joseph.o'[email protected]']
If you were entering information, press the BACK button in your browser and re-check the information you had entered to be sure you left no blank fields.

[yellow1912]

Which ZC version is it?

[peeceelee]

sorry, running 1.3.7

[yellow1912]

Edit:
includes/functions/functions_email.php

Replace line 136:

      $sql = $db->bindVars($sql, ':custEmailAddress:', $to_email_address, 'string'); 

by

      $sql = $db->bindVars($sql, ':custEmailAddress:', zen_db_input($to_email_address), 'string'); 

See if that helps.

[peeceelee]

I couldn't find that line of code in the file specified...

[DrByte]

You were given the wrong answer.

Change this section (approx line 115):

      $customers_email_format_read = $db->Execute("select customers_email_format from " . TABLE_CUSTOMERS . " where customers_email_address= '" . $to_email_address . "'");
      $customers_email_format = $customers_email_format_read->fields['customers_email_format'];
      if ($customers_email_format=='NONE' || $customers_email_format=='OUT') return; //if requested no mail, then don't send.
      if ($customers_email_format =='HTML') $customers_email_format='HTML'; // if they opted-in to HTML messages, then send HTML format

      //determine what format to send messages in if this is an "extra"/admin-copy email:
      if (ADMIN_EXTRA_EMAIL_FORMAT == 'TEXT' && substr($module,-6)=='_extra') {
        $email_html='';  // just blank out the html portion if admin has selected text-only
      }

to this:

      $sql = "select customers_email_format from " . TABLE_CUSTOMERS . " where customers_email_address= :custEmailAddress:";
      $sql = $db->bindVars($sql, ':custEmailAddress:', $to_email_address, 'string');
      $result = $db->Execute($sql);
      $customers_email_format = ($result->RecordCount() > 0) ? $result->fields['customers_email_format'] : '';
      if ($customers_email_format == 'NONE' || $customers_email_format == 'OUT') return; //if requested no mail, then don't send.
//      if ($customers_email_format == 'HTML') $customers_email_format = 'HTML'; // if they opted-in to HTML messages, then send HTML format

      // handling admin/"extra"/copy emails:
      if (ADMIN_EXTRA_EMAIL_FORMAT == 'TEXT' && substr($module,-6)=='_extra') {
        $email_html='';  // just blank out the html portion if admin has selected text-only
      }
      //determine what format to send messages in if this is an admin email for newsletters:
      if ($customers_email_format == '' && ADMIN_EXTRA_EMAIL_FORMAT == 'HTML' && in_array($module, array('newsletters', 'product_notification')) && isset($_SESSION['admin_id'])) {
        $customers_email_format = 'HTML';
      }

This gives you the code used in v1.3.8 ... which is worth upgrading your site to ...

[peeceelee]

thanks drbyte...will be upgrading to 1.3.8 soon