apostrophe problem with Media Clip

I am uploading song samples to my site and whenever a song title contains an apostrophe ' -- it gives me this error:

1064 You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near 'I Won't Have To Worry Anymore.mp3', now())' at line 5
in:
[insert into media_clips (media_id, clip_type, clip_filename, date_added) values ( '4', '1', 'Can't Get It.mp3', now())]
If you were entering information, press the BACK button in your browser and re-check the information you had entered to be sure you left no blank fields.

I know this is a stripslashes problem, but I'm not sure how to fix it. I added the php_value magic_quotes_gpc off to my htaccess file, but that did not fix the problem.

Can someone point me to the file that needs to be corrected and how to do this?

Thanks.

maybe escaping the apostrophe like this would work

I Won't Have To Worry Anymore.mp3

barco57:

maybe escaping the apostrophe like this would work

I Won't Have To Worry Anymore.mp3

No, it still gives me an error message when I do that.

When I go to Extras > Media Manager > Album

and edit that album to add a sound clip, I don't have the option of inputing a file name. If I did, then adding a forward slash to fix the problem would be easy.

I browse my computer to find the sound clip, then I upload it to the server. There is some code somewhere that is taking the name of the file and not stripping out the apostrophe. I need to know which file it is.

I can't believe no one has experienced this problem before. I've searched the forums and found some solutions, but none of them seem to work for me.

How important is it to keep the apostrophe in the filename?

DrByte:

How important is it to keep the apostrophe in the filename?

Well, to me, not important at all. But the way the link displays out on the site is.

The problem is, when you upload a sound clip, you don't get the option on putting in a file name to display as a link. Whatever the name is of the file you upload - in this case I Won't Have To Worry Anymore.mp3 - is the way it is displayed on the site.

So, if I change my file to read iwonthavetoworryanymore.mp3 - it will upload just fine and the link on the site will look like iwonthavetoworryanymore.mp3. That I do not want.

So, how do I get the filename stored without the apostrophe, but get the apostrophe to display on the site as a clickable link?

file - iwonthavetoworryanymore.mp3

Clickable link on the site: I Won't Have To Worry Anymore.mp3

Try this:

/admin/media_manager.php
around line 58 you'll see this:```
if ($media_upload->filename != 'none' && $media_upload->filename != '' && is_writable(DIR_FS_CATALOG_MEDIA . $_POST['media_dir'])) {

              $db->Execute("insert into " . TABLE_MEDIA_CLIPS . "
                            (media_id, clip_type, clip_filename, date_added) values (
                             '" . $_GET['mID'] . "',
                             '" . $media_type . "',
                             '" . $media_upload_filename . "', now())");
            }

change it to this instead:
if ($media_upload->filename != 'none' && $media_upload->filename != '' && is_writable(DIR_FS_CATALOG_MEDIA . $_POST['media_dir'])) {
$sql = "insert into " . TABLE_MEDIA_CLIPS . " (media_id, clip_type, clip_filename, date_added) values (:mID:, :mType:, :mFilename:, now())";
$db->bindVars($sql, ':mID:', $_GET['mID'], 'integer');
$db->bindVars($sql, ':mType:', $media_type, 'string');
$db->bindVars($sql, ':mFilename:', $media_upload_filename, 'string');
$db->Execute($sql);
}

Thanks for giving this a whirl, Dr. Byte, but it did not work. I still get the follow error message when I try to upload a file that contains an apostrophe:

1064 You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntax to use near ':mID:, :mType:, :mFilename:, now())' at line 1
in:
[insert into media_clips (media_id, clip_type, clip_filename, date_added) values (:mID:, :mType:, :mFilename:, now())]
If you were entering information, press the BACK button in your browser and re-check the information you had entered to be sure you left no blank fields.

Oops ... I knew I should have tested that ... but had to run off to something else just as I posted that.

Here's a correction:

[CODE]                if ($media_upload->filename != 'none' && $media_upload->filename != '' && is_writable(DIR_FS_CATALOG_MEDIA . $_POST['media_dir'])) {
                  $sql = "insert into " . TABLE_MEDIA_CLIPS . " (media_id, clip_type, clip_filename, date_added) values (:mID:, :mType:, :mFilename:, now())";
                  [B]$sql = [/B]$db->bindVars($sql, ':mID:', $_GET['mID'], 'integer');
                  [B]$sql = [/B]$db->bindVars($sql, ':mType:', $media_type, 'string');
                  [B]$sql = [/B]$db->bindVars($sql, ':mFilename:', $media_upload_filename, 'string');
                  $db->Execute($sql);
                }
```\[/CODE]

It worked perfectly! Thank you so much.

Thanks for the confirmation. This fix will be included in v1.4.0

:shocking:Strange

The fix works spot on but you posted this three years ago and we are only on 1.3.9:laugh:

Thanks for the fix :)