[Done v1.3.8] Apostrophes in customer emails results in MySQL errors

[rmullaney77]

ZC Version:
1.3.7

Filename:
/admin/orders.php

Problem:
When updating orders (status), a MySQL error is raised when choosing "notify customer" if the email addresses contains an apostrophy.

Solution:
Properly escape the email address in the resulting sql query used for the customer notification.

Comments:
An apostrophe, though uncommon, is a valid character in an email address. All queries that contain items that may have such characters should always be escaped before the query is executed. Technically, ALL queries should be escaped before execution just to be safe.

[DrByte]

The exact SQL error would be a great help in tracking this down.

[DrByte]

If it's the message I *think* you're getting, this should fix it:

/includes/functions/functions_email.php

around line 110 you'll find this:

      //determine customer's email preference type: HTML or TEXT-ONLY  (HTML assumed if not specified)
      $customers_email_format_read = $db->Execute("select customers_email_format from " . TABLE_CUSTOMERS . " where customers_email_address= '" . $to_email_address . "'");

Change it to this:

      //determine customer's email preference type: HTML or TEXT-ONLY  (HTML assumed if not specified)
      $customers_email_format_read = $db->Execute("select customers_email_format from " . TABLE_CUSTOMERS . " where customers_email_address= '" . zen_db_input($to_email_address) . "'");