zc157a may define customers_fax field to be varchar(32) in the customers table but there is no data field length checking on input of account creation.
In includes\templates\templates_default\templates\tpl_modules_create_account.php the telephone number is checked but the fax number is not
HTML Code:
<fieldset>
<legend><?php echo TABLE_HEADING_PHONE_FAX_DETAILS; ?></legend>
<label class="inputLabel" for="telephone"><?php echo ENTRY_TELEPHONE_NUMBER; ?></label>
<?php echo zen_draw_input_field('telephone', '', zen_set_field_length(TABLE_CUSTOMERS, 'customers_telephone', '40') . ' id="telephone" placeholder="' . ENTRY_TELEPHONE_NUMBER_TEXT . '"' . ((int)ENTRY_TELEPHONE_MIN_LENGTH > 0 ? ' required' : ''), 'tel'); ?>
<?php
if (ACCOUNT_FAX_NUMBER == 'true') {
?>
<br class="clearBoth" />
<label class="inputLabel" for="fax"><?php echo ENTRY_FAX_NUMBER; ?></label>
<?php echo zen_draw_input_field('fax', '', 'id="fax" placeholder="' . ENTRY_FAX_NUMBER_TEXT . '"', 'tel'); ?>
<?php
}
?>
</fieldset>
The result is
HTML Code:
PHP Fatal error: 1406:Data too long for column 'customers_fax' at row 1 :: INSERT INTO zen_customers (customers_firstname, customers_lastname, customers_email_address, customers_nick, customers_telephone, customers_fax, customers_newsletter, customers_email_format, customers_default_address_id, customers_password, customers_authorization) VALUES ....
and in the second case field sizes are checked for length on entry and storage to the db but Whos-online does no checking before trying to concatenate two max lenght fields.
Bookmarks