Quotes have issues affecting my product images [NOTE: magic_quotes_sybase issue]

Yes, I did notice.
I'm continuing discussion in this thread, because it contains relevant history, rather than a new post.

Using the very same product name and description as yourself, I cannot reproduce the problem on my own test servers (one of them using PHP v4.4.5 and MySQL 4.2.11-standard-log ... which makes configuration very similar to yours).

Your server's addslashes() function appears to be converting single-quotes to two single-quotes instead of a backslash and a single-quote.

There is a growing trend towards using '' instead of ' (considered to be "more portable" across database-engine choices, and safer in multi-byte server configurations), but that usually only happens by using the database-provided scripts for escaping content being prepared for insertion into the database.

I've been researching to find out whether/where addslashes() has been altered to produce '' instead of ' but haven't found it.

Hence the question about your PHP version.

Can you upload the techsupp.php file (you can find it in the zc_install folder of your Zen Cart files) to your server? (into your "cart" folder is fine), and post a link to it?

Specifically, I want to look at your magic_quotes settings for _runtime and _sybase.

Apparently having magic_quotes_sybase enabled will cause the use of single-quotes for escaping instead of backslashes.

Here is the link:
http://www.aaau.com/cart/techsupp.php

Strangely though, it gives me a 500 Internal Server Error and I'm not sure why. The logs mention nothing.

Nevermind, found the logs.

[11-Jun-2007 14:48:21] PHP Warning:  session_start(): Cannot send session cookie - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:21] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:21] PHP Warning:  Cannot modify header information - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/init_includes/init_templates.php on line 78
[11-Jun-2007 14:48:29] PHP Warning:  session_start(): Cannot send session cookie - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:29] PHP Warning:  session_start(): Cannot send session cache limiter - headers already sent (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/functions/sessions.php on line 108
[11-Jun-2007 14:48:29] PHP Warning:  Cannot modify header information - headers already sent by (output started at public_html/cart/techsupp.php:51) in public_html/cart/includes/init_includes/init_templates.php on line 78

The 500 error is probably some mod-security issue.

Try this:

• recreate the zc_install folder
• upload the zc_install/.htaccess file
• upload the zc_install/techsupp.php file

The .htaccess should work around the mod_security bit, and using the subfolder keeps the effect isolated to the zc_install folder.

http://www.aaau.com/cart/zc_install/techsupp.php

Still getting the same error. And yes, .htaccess is uploaded.

Puzzling.

Alternate approach...
Login into your admin
Choose Tools->Server Info

Search down the screen for magic_quotes and post what you find for the different variations.

(First on/off is Local, second is Master)
magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase On On

HDG:

(First on/off is Local, second is Master)
magic_quotes_gpc On On
magic_quotes_runtime Off Off
magic_quotes_sybase On On

Hmmm ... as I suspected.

PHP:

If magic_quotes_sybase is on, a single-quote is escaped with a single-quote instead of a backslash if magic_quotes_gpc or magic_quotes_runtime are enabled.

Now to come up with a workaround for you ...

I have access to change those, but I don't think I should. We have many clients on the server, some of which are not mine.

mysql_real_escape_string() wouldn't solve this, would it?

Actually, it's pretty simple.

You don't want magic_quotes_runtime operating on your server anyway, as it creates endless chaos, such as we're discussing today.

In fact, even PHP's plans are to drop it in the future. Zen Cart is already going to be disabling it by default when it runs, starting with the upcoming v1.3.8.

The fix, which should work universally, is this:

edit /includes/application_top.php
around line 15 you'll see this:```
/**

• boolean if true the autoloader scripts will be parsed and their output shown. For debugging purposes only.
  */
  define('DEBUG_AUTOLOAD', false);
  insert the following on line 15, before the code that's already there:
  set_magic_quotes_runtime(0);

HDG:

I have access to change those, but I don't think I should. We have many clients on the server, some of which are not mine.

mysql_real_escape_string() wouldn't solve this, would it?

The problem immediately at-hand is unrelated to database things. Insomuch as database issues are concerned, Zen Cart already handles slashes strategically.

In the situation you reported, Zen Cart is using addslashes() on your product name specifically to "add slashes" to it so that javascript will encounter the slashes and treat them accordingly.
The addslashes() function was ill-conceived when it was designed, and sadly is still tied to database things, but shouldn't be.
All we want the addslashes() function to do in this case is to truly "add slashes".

But, with your server using magic_quotes_runtime and having magic_quotes_sybase enabled, your PHP's addslashes() function is behaving differently than desired.

DrByte:

Actually, it's pretty simple.

You don't want magic_quotes_runtime operating on your server anyway, as it creates endless chaos, such as we're discussing today.

In fact, even PHP's plans are to drop it in the future. Zen Cart is already going to be disabling it by default when it runs, starting with the upcoming v1.3.8.

The fix, which should work universally, is this:

edit /includes/application_top.php
around line 15 you'll see this:```
/**

• boolean if true the autoloader scripts will be parsed and their output shown. For debugging purposes only.
  */
  define('DEBUG_AUTOLOAD', false);
  insert the following on line 15, before the code that's already there:
  set_magic_quotes_runtime(0);

Doing that, will it turn if off for the whole server? Or just for this account?

I have a feeling there was a reason these were turned on, I wish I knew why.

HDG:

Doing that, will it turn if off for the whole server? Or just for this account?

I have a feeling there was a reason these were turned on, I wish I knew why.

What I recommended will only affect your Zen Cart operation. It will not touch anything else on the server.

Okay thanks.

Here is what the change looks like:

set_magic_quotes_runtime(0);
/**
 * boolean if true the autoloader scripts will be parsed and their output shown. For debugging purposes only.
 */
define('DEBUG_AUTOLOAD', false);

But it seems like the image is still not appearing.

How much control do you have over the server config?
Who is your hosting company?

I'm wondering if your PHP is setup to ignore overrides on set_magic_quotes_runtime :cry:

I have full control over the server (root access), although I generally do not like to change configs without knowing why that config was originally changed in the first place.

We are the hosting company, although the actual server is in FL. We are in NY.

HDG:

I have full control over the server (root access), although I generally do not like to change configs without knowing why that config was originally changed in the first place.

We are the hosting company...
I suppose I'll have to leave you to research why you're using those settings then.

If you research issues around magic_quotes_runtime, you'll see that there is a huge move away from using them. Why your server is setup to specifically use them and to use the _sybase settings also ... is a mystery.

From what little information I could find, apparently they were turned on for some photo gallery software... or something.

Thanks for all the help though. :)

in the application_top.php, add both of these:

set_magic_quote_runtime(0);
ini_set('magic_quotes_sybase', 0);