[geeklog-users] An SQL error has occured

[Chris Besignano]

I am not using the Journal Plugin. Just staight-up geeklog. The topic I 
was creating just happened to include the word Journal.

Tony Bibbs wrote:

> Again, note that the *fix* will happen in the journal plugin's code.  
> If you find it and fix it please send the fix to 
> geeklog-devtalk at lists.geeklog.net.  Thanks for looking into this...
>
> --Tony
>
> Chris Besignano wrote:
>
>> I realized why the error occured but was unable to resolve the issue. 
>> Geeklog simply locked up and kept returning the SQL error no matter 
>> which page I accessed. I agree that this is something that should be 
>> validated. It shouldn't be much work to make it happen, maybe I'll 
>> poke at it this weekend and add some validation code. Who do I send 
>> my changes to?
>>
>> Chris Besignano
>>
>> Drago Goricanec wrote:
>>
>>> This is something geeklog should protect against. Either escape the 
>>> data, or
>>> validate it prior to injecting it into SQL. If there are plans to do 
>>> this in a
>>> future version that's fine, but I don't think it's reasonable for 
>>> geeklog to
>>> expect users to provide it with valid data.
>>>
>>> The other thing I would suggest is that either we always use POST 
>>> methods, or
>>> encrypt and sign the arguments generated in a GET method to avoid 
>>> either
>>> replaying or injecting bad data to geeklog. Nevertheless, all data 
>>> should be
>>> validated/sanitized prior to use.
>>>
>>> regards,
>>> Drago
>>>
>>> Quoting Tony Bibbs <tony at tonybibbs.com>:
>>>
>>>  
>>>
>>>> the problem is the journal name has a single quote (') in it.  
>>>> Change "Chris' Journal" to "Chris Journal" and all  would be well.
>>>>
>>>> --Tony
>>>>
>>>> Chris Besignano wrote:
>>>>  
>>>>
>>>>> Hello,
>>>>>
>>>>> I am runnning geeklog 1.3.8-lsr4 on linux. I attempted to add a 
>>>>> new topic, but left a space in the topic id. Now I get this SQL 
>>>>> error and cannot access any part of the site. What can I do to 
>>>>> recover from this? Below is a section of my error log.
>>>>>
>>>>>
>>>>> Thu Feb 26 09:51:31 2004 - 1064: You have an error in your SQL 
>>>>> syntax near 'Journal')' at line 1. SQL in question: SELECT 
>>>>> count(*) AS count FROM gl_stories WHERE (draft_flag = 0) AND (date 
>>>>> <= NOW()) AND (tid = 'Chris'Journal')
>>>>> Thu Feb 26 09:51:46 2004 - 1064: You have an error in your SQL 
>>>>> syntax near 'Journal')' at line 1. SQL in question: SELECT 
>>>>> count(*) AS count FROM gl_stories WHERE (draft_flag = 0) AND (date 
>>>>> <= NOW()) AND (tid = 'Chris'Journal')
>>>>> Thu Feb 26 09:51:52 2004 - 1064: You have an error in your SQL 
>>>>> syntax near 'Journal')' at line 1. SQL in question: SELECT 
>>>>> count(*) AS count FROM gl_stories WHERE (draft_flag = 0) AND (date 
>>>>> <= NOW()) AND (tid = 'Chris'Journal')
>>>>> Thu Feb 26 09:51:56 2004 - 1064: You have an error in your SQL 
>>>>> syntax near 'Journal')' at line 1. SQL in question: SELECT 
>>>>> count(*) AS count FROM gl_stories WHERE (draft_flag = 0) AND (date 
>>>>> <= NOW()) AND (tid = 'Chris'Journal')
>>>>>
>>>>> _______________________________________________
>>>>> geeklog-users mailing list
>>>>> geeklog-users at lists.geeklog.net
>>>>> http://lists.geeklog.net/listinfo/geeklog-users
>>>>>     
>>>>
>>>>
>>>> _______________________________________________
>>>> geeklog-users mailing list
>>>> geeklog-users at lists.geeklog.net
>>>> http://lists.geeklog.net/listinfo/geeklog-users
>>>>
>>>>   
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> geeklog-users mailing list
>>> geeklog-users at lists.geeklog.net
>>> http://lists.geeklog.net/listinfo/geeklog-users
>>>
>>>  
>>>
>>
>> _______________________________________________
>> geeklog-users mailing list
>> geeklog-users at lists.geeklog.net
>> http://lists.geeklog.net/listinfo/geeklog-users
>
> _______________________________________________
> geeklog-users mailing list
> geeklog-users at lists.geeklog.net
> http://lists.geeklog.net/listinfo/geeklog-users
>