#23 backquotes in listTables return not handled

[Anonymous]

The possibility of backtick-quoted return values from
the DBI module is not accounted for. This causes
problems when creating a site with a multi-select
enumeration field ('set'). The string concatenation
operation on line 197 of create_menus.cgi produces
unparseable output if the table name being operated on
is backtick-quoted.

I found that stripping all backticks from the return
value of listTables fixed the problem, but this assumes
that none of your table names contains odd characters
which would require quoting.

/usr/local/share/perl/5.8.7/mySiteMaker/Source.pm:393
--
sub listTables {
$self = shift;
my @results;
$self->{err} = FALSE;

@results = $self->{dbh}->tables();
if($DBI::err) {
$ERROR = "$LERRSQL ".$DBI::errstr."\n";
$self->{err} = TRUE;
}
+ # remove any backtick-quoting
+ grep(y/\`//d && 0,@results);
return @results;
}

--

Another option would be to replace the concatenation
statement at create_menus.cgi:197

# with this possibility and keep things normalized.
my $dot_to_underscore = $column_name;
$dot_to_underscore =~ s/\./_/g;
- #my $normalized_table_name =
$option_table."_to_".$dot_to_underscore;
+ my $option_table_sane = $option_table;
+ $option_table_sane =~ y/\`//d;
+ my $normalized_table_name =
"\`".$option_table_sane."_to_".$dot_to_underscore."\`";

# create the new table

$mySMDB->createRelationTable($normalized_table_name);

--

but this would have to be replicated anywhere else such
a concatenation occurs (I haven't noticed any so far
though).

I found this problem using mysql-server 4.0.24-10 and
libdbi-perl 1.48-1 from debian sarge.

Andrew Gallagher
andrewg at andrewg dot com

[Satya]

Logged In: YES
user_id=1022771

Alright, I'll use the second method. We'll see if it works.
Should be in CVS soon.
Thanks.