Authorize.net AIM problem with apostrophe in 1.3.7.1

Hey gang,

I updated to 1.3.7.1 over the weekend from 1.3.6
I reinstalled my Authorize.net AIM modules, but I am running across a failure in receiving a transaction approval when an apostrophe is contained in certain fields.

This was working perfectly in 1.3.6

The error is happening in /includes/modules/payment/authorizenet_aim.php

Right now, I have commented out the description and company fields to send to authorize.net for card approval. These are the 2 fields that have errored for us since the upgrade.
The credit card would approve at authorize.net, then fail when it came back to us so the order would not complete. One customer's error code from today is at the bottom of this thread.

My question, is there a way to take the following code and insert a command that will STRIP out the quotes (single and double- to make sure) before it's sent to authorize.net. OR, a fix to this problem overall that I didn't know about

thanks,
Jeff Michaels

Here is my modified code from line 315 to stop the current problem for me today.

// Populate an array that contains all of the data to be sent to Authorize.net
$submit_data = array(
'x_login' => MODULE_PAYMENT_AUTHORIZENET_AIM_LOGIN, // The login name is assigned by authorize.net
'x_tran_key' => MODULE_PAYMENT_AUTHORIZENET_AIM_TXNKEY, // The Transaction Key is generated through the merchant interface
'x_relay_response' => 'FALSE', // AIM uses direct response, not relay response
'x_delim_data' => 'TRUE', // The default delimiter is a comma
'x_version' => '3.1', // 3.1 is required to use CVV codes
'x_type' => MODULE_PAYMENT_AUTHORIZENET_AIM_AUTHORIZATION_TYPE == 'Authorize' ? 'AUTH_ONLY': 'AUTH_CAPTURE',
'x_method' => 'CC', //MODULE_PAYMENT_AUTHORIZENET_AIM_METHOD == 'Credit Card' ? 'CC' : 'ECHECK',
'x_amount' => number_format($order->info['total'], 2),
'x_card_num' => $_POST['cc_number'],
'x_exp_date' => $_POST['cc_expires'],
'x_card_code' => $_POST['cc_cvv'],
'x_email_customer' => MODULE_PAYMENT_AUTHORIZENET_AIM_EMAIL_CUSTOMER == 'True' ? 'TRUE': 'FALSE',
'x_email_merchant' => MODULE_PAYMENT_AUTHORIZENET_AIM_EMAIL_MERCHANT == 'True' ? 'TRUE': 'FALSE',
'x_cust_id' => $_SESSION['customer_id'],
'x_invoice_num' => (MODULE_PAYMENT_AUTHORIZENET_AIM_TESTMODE == 'Test' ? 'TEST-' : '') . $new_order_id,
'x_first_name' => $order->billing['firstname'],
'x_last_name' => $order->billing['lastname'],
// 'x_company' => $order->billing['company'],
'x_address' => $order->billing['street_address'],
'x_city' => $order->billing['city'],
'x_state' => $order->billing['state'],
'x_zip' => $order->billing['postcode'],
'x_country' => $order->billing['country']['title'],
'x_phone' => $order->customer['telephone'],
'x_email' => $order->customer['email_address'],
'x_ship_to_first_name' => $order->delivery['firstname'],
'x_ship_to_last_name' => $order->delivery['lastname'],
'x_ship_to_address' => $order->delivery['street_address'],
'x_ship_to_city' => $order->delivery['city'],
'x_ship_to_state' => $order->delivery['state'],
'x_ship_to_zip' => $order->delivery['postcode'],
'x_ship_to_country' => $order->delivery['country']['title'],
// 'x_description' => $description,
// Merchant defined variables go here
'Date' => $order_time,
'IP' => $_SERVER['REMOTE_ADDR'],
'Session' => zen_session_id());

Here is the error I had gotten from a customer today within the 'company' field transmitted to authorize.net that brought all of this to light!

1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's School of Voi [x_address] => 204 Shannon Dr. [x_city] => Henderson ' at line 1
in:
[insert into authorizenet (id, customer_id,order_id, response_code, response_text, authorization_type, transaction_id, sent, received, time, session_id) values ('', '26325', '16300', '1', 'This transaction has been approved.', 'auth_only', '', 'Array ( [x_login] => ******* [x_tran_key] => ******* [x_relay_response] => FALSE [x_delim_data] => TRUE [x_version] => 3.1 [x_type] => AUTH_ONLY [x_method] => CC [x_amount] => 8.00 [x_card_num] => 3315 [x_exp_date] => 0509 [x_card_code] => ******* [x_email_customer] => FALSE [x_email_merchant] => FALSE [x_cust_id] => 26325 [x_invoice_num] => 16300 [x_first_name] => Kimberlie [x_last_name] => Helton [x_company] => Kimberlie Helton's School of Voi [x_address] => ***** [x_city] => ******* [x_state] => ******** [x_zip] => ******* [x_country] => United States [x_phone] => ********* [x_email] => bkjb@ [x_ship_to_first_name] => [x_ship_to_last_name] => [x_ship_to_address] => [x_ship_to_city] => [x_ship_to_state] => [x_ship_to_zip] => [x_ship_to_country] => [Date] => November 13, 2007, 11:00 am [IP] => 24.176.117.10 [Session] => 18d37d0e25616017310f6e91fa9cd731 [url] => https://secure.authorize.net/gateway/transact.dll ) ', '1=1&2=1&3=1&4=This+transaction+has+been+approved.&5=013401&6=Y&7=&8=16300&9=&10=8.00&11=CC&12=auth_only&13=26325&14=Kimberlie&15=Helton&16=Kimberlie+Helton%27s+School+of+Voi&17=&18=&19=&20=38340&21=United+States&22=&23=&24=********&25=&26=&27=&28=&29=&30=&31=&32=&33=&34=&35=&36=&37=&38=695A7FAA77530259FBF01A59BE86580F&39=&40=&41=&42=&43=&44=&45=&46=&47=&48=&49=&50=&51=&52=&53=&54=&55=&56=&57=&58=&59=&60=&61=&62=&63=&64=&65=&66=&67=&68=&69=November+13+2007+11%3A00+am&70=24.176.117.10&71=18d37d0e25616017310f6e91fa9cd731', 'November 13, 2007, 11:00 am', '18d37d0e25616017310f6e91fa9cd731')]

http://www.zen-cart.com/forum/showthread.php?t=55088&highlight=authorizenet+apostrophe

Is the "apostrophe" issue now a non-issue in version 1.3.8a? I remember we also had an issue with Zen Cart order numbers bumping into each other in authorize.net and causing problems to the extent that we had to add a mod to generate order id's externally.

Will the upgrade to v 1.3.8a eliminate the need for these apostrophe and order id fixes?

Thanks.

The apostrophe issue is resolved in 1.3.8.

As to the order IDs being unique, this should be resolved as well. The module now adds a 4-character unique identifier to the order number to prevent duplication.