SQL error on spell forms.

[relentless]

Hey Petu,

When I type anything in the form with a ' in it, it'll generate this error. Guess you need to addslash() to all the form fields in the backend.

spells.php
MYSQL_QUERY
SELECT spells.* FROM spells WHERE 1=1 AND name like '%prophet's%gift%' ORDER BY name
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's%gift%' ORDER BY name' at line 3
Have you sourced the eqbrowser tables in your database ?

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /mnt/web8/31/73/51034773/htdocs/forest/webtools/spellss.php on line 51
# No spells found matching those criterias.
Just a heads up.

Relentless

[relentless]

Code: Select all

'%prophet's%gift%'

Also need to decode the HTML entities on the form field as well, in addition to the addslashes...not sure if you already store spaces as % in your tables.

[Topsy]

Well until the fix gets implimented, you'll just have to put a \ before your '.

hope that helps

[Topsy]

*fixed*

[Koeril]

New error when searching any spell

spells.php
MYSQL_QUERY
AND name like '%Hallowed%' ORDER BY name
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AND name like '%Hallowed%' ORDER BY name' at line 1

[Topsy]

fixed