[Done 1.3.6] 1.3.0.1 Admin, send emails, apostrophies in email cause sql error

18 Aug 2006, 11:05 AM

futurefreak

New Zenner

Join Date:: Aug 2005
Posts:: 13
Plugin Contributions:: 0

[Done 1.3.6] 1.3.0.1 Admin, send emails, apostrophies in email cause sql error

Version 1.3.0.1 in Admin area -> send emails

Apostrophies (single quotes) in emails are not escaped properly and cause sql errors.

e.g. JohnO'[email protected]

28 Aug 2006, 11:41 PM

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,515
Plugin Contributions:: 176

Re: [Done 1.3.6] 1.3.0.1 Admin, send emails, apostrophies in email cause sql error

Wondering if there's an RFC out there explaining in what context apostrophes are acceptable, as well as other acceptable characters in email names and email addresses ... as far as standards go.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

3 Sep 2006, 2:34 AM

theoracle

Suspended

Join Date:: Aug 2004
Posts:: 3,180
Plugin Contributions:: 1

Re: [Done 1.3.6] 1.3.0.1 Admin, send emails, apostrophies in email cause sql error

Make a backup of your admin/email.php file.

Then, on that same file,

find:

$audience_select = get_audience_sql_query($_POST['customers_email_address'], 'email');

replace with:

$audience_select = get_audience_sql_query(addslashes($_POST['customers_email_address'], 'email'));

Then, find:

$audience_select = get_audience_sql_query($_POST['customers_email_address']);

replace with:

$audience_select = get_audience_sql_query(addslashes($_POST['customers_email_address']));