jeking:
This was working fine. I'm not sure when the problem started. This occurs only on one, not very popular product.
When clicking Add to Cart, I get:
WARNING: An Error occurred, please refresh the page and try again.
Error log contains:
PHP Fatal error: 1064:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'and products_id = 110
OR (options_id = 3 AND options_values_' at line 4 :: select products_attributes_id
from products_attributes
where options_values_id =
and products_id = 110
OR (options_id = 3 AND options_values_id = 0 AND products_id = 110)
order by products_attributes_id ==> (as called by) /home/agag/public_html/includes/functions/extra_functions/products_with_attributes.php on line 350 <== in /home/agag/public_html/includes/classes/db/mysql/query_factory.php on line 167
Zen Cart 1.5.1a
SBA Version 1.5.4 for Zen Cart Version 1.5.5a
The item has one attribute which is not tracked by SBA, the option type is Text. When I do add it, I get the same error. If I add a second attribute, no error. It will add to cart.
https://www.shopasgoodasgold.com/donation-gifts-c-12/blue-bandanna-p-110
The version of that file is from Mar 27, 2016 or earlier (older). There is some code that was added above there at a later time to address that potential result, and actually as the plugin stands, that file no longer contains execution code (all commented out), but the installer has not been updated to remove it. If you wish to continue using that version of the software, there is a single fix for that area of the code:
At/around line 320 change:
if ($multi) {
$first_search = 'where options_values_id in (' . implode(',', $temp_attributes) . ')'; // This helps make a list of items where the options_values_id is compared to each individual attribute ("x","y","z")
} else {
$first_search = 'where options_values_id = ' . implode(',', $temp_attributes); // This helps make a list of items where the options_values_id is compared to each individual attribute ("x","y","z")
// $first_search = 'where options_values_id = "' . $attribute . '"';
}
to the following by adding the below highlighted if statement:
if ($multi) {
$first_search = 'where options_values_id in (' . implode(',', $temp_attributes) . ')'; // This helps make a list of items where the options_values_id is compared to each individual attribute ("x","y","z")
} else {
$first_search = 'where options_values_id = ' . implode(',', $temp_attributes); // This helps make a list of items where the options_values_id is compared to each individual attribute ("x","y","z")
if (implode(',', $temp_attributes) == "") {
$first_search = 'where options_values_id = 0'; // This helps make a list of items where the options_values_id is compared to each individual attribute ("x","y","z")
}
// $first_search = 'where options_values_id = "' . $attribute . '"';
}
Also, above that code area is some missing sanitization that is shown in the current version of that function which is located in includes/classes/class.products_with_attributes_class_stock.php around line 453 of that file as available from github.
} elseif ($optvalid == 0) {
$specAttributes[$optid] = (int)$optvalid;
} elseif (is_array($optvalid)) {
if ($multi == false && count($optvalid) > 1) {
$multi = true;
}
foreach($optvalid as $optid2=>$optvalid2) {
$temp_attributes[] = (int)$optvalid2;
}
} elseif (true) { // mc12345678 Here is one place where verification can be performed as to whether a particular attribute should be added. This is probably the best place to do the review because all aspects of the attribute are available.
$temp_attributes[] = (int)$optvalid;
}
Lastly, though I stopped searching backwards to see when line 350 had become the sql execution line to present that error, this link shows all of the changes that have been made since March 27, 2016: https://github.com/mc12345678/Stock_By_Attributes_Combined/compare/a85542c05ba0047e10759a9be1aae464bcfb5d4d...master
