Problems with apostrophes in my product search.

When i type the full name of a product into the site search it seems to be fire a 1064 error:

it would appear this is because within the product name there is a ' which has subsequently knocked the mysql code. Any tips for fixing?

Andy.

EDIT

Version 1.3.8a

Andy,

This does not happen on my 1.3.8a.... albeit I have modified my search a lot. What is the keyword you are typing in?

Shrimp

well the thing i typed in was the exact name of a product which happens to contain an '

e.g

that's amore

will break the query because it contains an apostraphy.

Andy.

will check on it

Works on mine.... have you made any changes to your code?

Hey Shrimp,

to the best of my knowledge nothing has been changed on this. Perhaps there was an update to 1.3.8a that i missed which corrected the problem ill have a look. Basicaly i either need to having somthing remove any invalid chars like ' etc. Or for these to be handled in a different way.

ill have alook see if there are any minor tweeks that may have been released.

Andy.

Andy_GS:

Hey Shrimp,

to the best of my knowledge nothing has been changed on this. Perhaps there was an update to 1.3.8a that i missed which corrected the problem ill have a look. Basicaly i either need to having somthing remove any invalid chars like ' etc. Or for these to be handled in a different way.

ill have alook see if there are any minor tweeks that may have been released.

Andy.

Andy,

Checked a couple in the live showcase and they worked fine.... checked the one in this thread and it didn't work:

http://www.zen-cart.com/forum/showthread.php?t=136173

I'm supposing since none on the dev team have responded that they think something has been modified on your cart to cause this..... you can take the ' out of the keywords but then the searches will not pull back the items you want them to pull back.

Shrimp

I just checked that site from that thread, and typed this in:

a'dobe

and it came back with the exact same error i get.

I just check this one:
http://www.boxandsupply.com

and they seem to add a \ where ever there is an '.

im guessing some sorter:

$var("'","\'",$var);

needs to be put somewhere or somthing similar, but i can't quite see from the /includes/modules/pages/advanced_search_result/header_php.php where exactly it should go.

any ideas?

Andy.

An apostrophe (or single quote) is a special character in php denoting the beginning or end of a string. Putting a \ in front of is "escapes" it - meaning it tells the php that the character shouldn't be intrepreted as the start/end of a string. This has nothing to do with Zen Cart. It's the way php works.

Yeah i understand that '' are used within php and that is the reason its not working as stated above.

So somewhere in the code this tag must be used:

mysql_real_escape_string

does this go in:
/includes/modules/pages/advanced_search/header_php.php

or

/includes/modules/pages/advanced_search_result/header_php.php

and if so where abouts?

kind regards

Andy.

Hey all,

i was just updating this hoping that it might fix my other issue with the zen-cart search which was to escape any invalid characters within the search e.g.

using:
addslashes($str);

to prevent things like a search for O'reily where the apostraphe needs to have slashes applied to it.

Is there a way i can add this to the update?

also is this piece of code not supposed to have a php close at the end?

regards
Andy.

Andy_GS:

also is this piece of code not supposed to have a php close at the end?
No.
Ref: https://www.zen-cart.com/tutorials/index.php?article=313

Hi doc,
thats interesting to know,
many thanks
Andy.

Hmm, no one still has come back to me with a definitive answer. If other peoples search escapes the use of a single apostraphe then could they share where and in what file this is done, because im struggling here to find the correct place to stop this from happening.

thanks in advance.

Andy.

is this a correct search ?
http://demo.zen-cart.at/index.php?main_page=advanced_search_result&search_in_description=1&keyword=HUGO13+with+%27+%28apostrophes%29

Andy_GS:

Hmm, no one still has come back to me with a definitive answer. If other peoples search escapes the use of a single apostraphe then could they share where and in what file this is done, because im struggling here to find the correct place to stop this from happening.

thanks in advance.

Andy.Zen Cart does it's best to add the slashes when preparing the input for the database (and is successful on every site that I've tested this morning). You'll find this done in the query factory class (lines 54-62). But as you'll also see, this is dependent upon you using a version of PHP that includes the escaping functions, and your web host not having disabled them.

Hey guys,

@hugo13 - yep that does seem to work

@kuroi - I was starting to believe myself that this was the file i needed to change.
What i have done is this:

Lines 364 - 369

  case 'regexp':
        $searchArray = array('[', ']', '(', ')', '{', '}', '|', '*', '?', '.', '$', '^');
        foreach ($searchArray as $searchTerm) {
          $value = str_replace($searchTerm, '\\' . $searchTerm, $value);
        }
        return $this->prepare_input($value);

i changed the last line to this:

return addslashes($value);

which pretty much makes the above search array redundant. but for all those experiencing my problem this seem to fix it for me.

so the final bit displays as:

  case 'regexp':
        $searchArray = array('[', ']', '(', ')', '{', '}', '|', '*', '?', '.', '$', '^');
        foreach ($searchArray as $searchTerm) {
          $value = str_replace($searchTerm, '\\' . $searchTerm, $value);
        }
        return addslashes($value);

Enjoy
Andy.

ok i don't know what happened but i changed it and was convinced i had it working....... yeah its not lol :oops::(