Error message 1

[keepingbusy]

All

I am new to this forum so if I am missing anything, please let me know and I'll add it as we go along.

I have recently been involved in the setting up of a website powered by OScommerce. The installation, cosmetic changes and other add-ons have all been succesful and the project is still ongoing.

Part of the process I was learning about was how to download the structure of the table/database that allows us to add our own catalog of items (as there are several thousands) and then upload it back to our site.

Here's where the problem lies.

For those familiar with OScommerce:

You can download the structure - Fine
You can view the file to see the set up - Fine

When you try and either upload the unchanged or changed file I get an error message.

I have posted a request for the fix/answer on the OScommerce Forum but with no reply at present.

Firstly, here is the error

File uploaded.
Temporary filename: /tmp/php4aVjQt
User filename: EP2006Jun30-1301.txt
Size: 3918
1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's'' at line 4

SELECT man.manufacturers_id FROM manufacturers as man WHERE man.manufacturers_name = 'CD's'

[TEP STOP]

Secondly, is this an OScommerce problem or can one of the php files be edited and the sql code be amended with help from this forum?

What else do you need to know, if anything guys?

Many thanks in anticipation of a reply

Lee

 

[TonyGroves]

You need to make sure that any literal strings in your SQL statements are properly escaped. This means prefixing any singe- or double-quotes with a backslash. In your example, you would need to have:[tt]
WHERE man.manufacturers_name = 'CD\'s'
[/tt]

 

[keepingbusy]

TonyGroves

Thank you for the response. I'll check that out and post back with the result

Lee

 

[keepingbusy]

Hi TonyGroves

My sincere thanks to you for supplying the answer. It seems the upload doesn't like the character ' anywhere. In fact it threw back errors in sentences like Greatest Hit's etc. I have changed categories such as CD's to CD and DVD's to DVD and it works perfect.

I have another issue now but that's not MySQL related.

Once again I'm grateful to you

Lee

 

[KarveR]

wild stab at this also being PHP related, for which this could be useful reading:

http://uk.php.net/manual/en/function.mysql-escape-string.php

______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[keepingbusy]

Hi KarveR

Thank you for the post

Lee