problem with ipn_main_handler...

[carlwhat]

i recently got the following log. it seems that we are not cleansing the data coming back from paypal? (i rarely use or support it.)

it seems that \xa0 is actually non-breaking space in Latin1 (ISO 8859-1).

is this a paypal setting that i have wrong? or do we need to make a coding change?

log (some elements changed to protect the innocent):

[06-Jul-2022 07:54:06] Request URI: /ipn_main_handler.php, IP address: 173.0.81.65
#1  trigger_error() called at [/myHome/includes/classes/db/mysql/query_factory.php:171]
#2  queryFactory->show_error() called at [/myHome/includes/classes/db/mysql/query_factory.php:143]
#3  queryFactory->set_error() called at [/myHome/includes/classes/db/mysql/query_factory.php:270]
#4  queryFactory->Execute() called at [/myHome/includes/functions/database.php:44]
#5  zen_db_perform() called at [/myHome/ipn_main_handler.php:419]
--> PHP Fatal error: 1366:Incorrect string value: '\xA0east ...' for column `mydatabase`.`paypal`.`address_state` at row 1 :: INSERT INTO paypal 
(order_id, txn_type, module_name, module_mode, reason_code, payment_type, payment_status, pending_reason, invoice, mc_currency, first_name, 
last_name, payer_business_name, address_name, address_street, address_city, address_state, address_zip, address_country, address_status, 
payer_email, payer_id, payer_status, payment_date, business, receiver_email, receiver_id, txn_id, parent_txn_id, num_cart_items, mc_gross, mc_fee, 
settle_amount, settle_currency, exchange_rate, notify_version, verify_sign, date_added, memo) VALUES ('236947', 'parent', 'paypal (ipn-handler)', 'IPN', 
'refund', 'instant', 'Refunded', '', '2588-1622644268-[mystore]', 'USD', 'kristen', 'smith', '', 'kris smith', '555 somewhere Drive', 'Eastbourne', '<A0>east 
sussex', 'BN208AR', 'United Kingdom', '', 'myemail######################', '8WQ3AK9PLLZK8', '', '2022-07-06 04:53:59', 
'myemail######################', 'myemail######################', '5AEL7BMZHK86N', '68422392U6908592X', 
'5E876138AL509150Y', '1', '-149.40', '0.00', '0', '', '1', '3.9', 'ATKG0W3.Sgjo.GzJn2YUDDvu5565Loi8lHe0SofBB2XQf7M02Hhp', now(), '{Record generated 
by IPN} [ProtectionEligibility:Eligible]') ==> 
(as called by) /myHome/includes/functions/database.php on line 44 <== in /myHome/includes/classes/db/mysql/query_factory.php on line 171.

[swguy]

I wonder if we need to sanitize the data that comes back from PayPal. Guilty until proven innocent!

[carlwhat]

I wonder if we need to sanitize the data that comes back from PayPal. Guilty until proven innocent!

clearly in this example, it is warranted...

[swguy]

I reckon so. Please PR.