A Conversation for New h2g2 Feedback
BR: Apostrophe in username = SQL problem
dElaphant (and Zeppo his dog (and Gummo, Zeppos dog)) - Left my apostrophes at the BBC Started conversation Oct 17, 2011
This might be a very serious bug.
I went to edit my username again, and this time got two errors.
1. Trying to change my name to "d'Elaphant (and Zeppo is dog (and Gummo, Zeppo's dog))"
resulted in this error at the bottom of the page:
Warning: odbc_exec(): SQL error: [unixODBC][FreeTDS][SQL Server]Incorrect syntax near 'Elaphant'., SQL state 37000 in SQLExecDirect in /var/www/noresearcherleftbehind/application/models/Users.php on line 303
2. Trying it again, taking out the apostrophe in "d'Elaphant" but leaving in the one in "Zeppo's" resulted in this error:
Warning: odbc_exec(): SQL error: [unixODBC][FreeTDS][SQL Server]Unclosed quotation mark after the character string ' WHERE [UserID]=18695 '., SQL state 37000 in SQLExecDirect in /var/www/noresearcherleftbehind/application/models/Users.php on line 303
It looks like you can use an apostrophe to create an SQL injection, which could cause all sorts of trouble.
ooooh no guide entry on "sql injection". Must add that to my "to do" list. 
BR: Apostrophe in username = SQL problem
Asteroid Lil - Offstage Presence Posted Oct 18, 2011
d'E, I'll report this and quote you verbatim. I only just started getting chops in javascript by dint of the scripts you wrote the other year -- SQL is a whole nother bucket of fish.
BR: Apostrophe in username = SQL problem
IctoanAWEWawi Posted Oct 18, 2011
"Incorrect syntax near 'Elaphant'."
heheh, I'm stealing that...
BR: Apostrophe in username = SQL problem
TRiG (Ireland) A dog, so bade in office Posted Oct 25, 2011
Since we don't yet have our own Guide Entry on SQL injections, I'll direct you to Bobby Tables, and reiterate that this could be a very very serious bug, which could lead to a corrupted database (I hope we have backups).
http://xkcd.com/327/
http://bobby-tables.com/
TRiG.
BR: Apostrophe in username = SQL problem
You can call me TC Posted Oct 25, 2011
I tried to change my name today and couldn't call myself Trillian's Child - presumably because of the apostrophe. I didn't get the error message, though.
BR: Apostrophe in username = SQL problem
dElaphant (and Zeppo his dog (and Gummo, Zeppos dog)) - Left my apostrophes at the BBC Posted Oct 26, 2011
I forgot about Bobby Tables. And we do now have an (as yet unedited) entry on SQL Injection. I'll have to add the link to the xkcd comic. And I would share the link to my entry, but my user page has gone missing - I'm hoping that last one is a transient issue this morning.
Aha - still in my browser history - A87709783
BR: Apostrophe in username = SQL problem
six7s Posted Oct 26, 2011
Try using ’ instead of an apostrophe in your screen name - it works 
BR: Apostrophe in username = SQL problem
six7s Posted Oct 27, 2011
... or... rather... it works intermittently...
Weird
BR: Apostrophe in username = SQL problem
You can call me TC Posted Oct 27, 2011
For posterity: six7s name appears like this at the moment:
six7s - ’ is an apostrophe
BR: Apostrophe in username = SQL problem
aka Bel - A87832164 Posted Oct 27, 2011
Well, that's a curly quote. Try ' for a proper straight apostrophe.
BR: Apostrophe in username = SQL problem
six7s Posted Oct 27, 2011
What I meant by "weird" is that sometimes it looks like what TC posted...
And sometimes it looks like this:
six7s - ’ - it’s an apostrophe
Some sorta caching bug?
Anyhoo... that's a whole nother kettle of piranhas
Back on topic:
the SQL injection bug does have a 'workaround'
Key: Complain about this post
BR: Apostrophe in username = SQL problem
- 1: dElaphant (and Zeppo his dog (and Gummo, Zeppos dog)) - Left my apostrophes at the BBC (Oct 17, 2011)
- 2: Asteroid Lil - Offstage Presence (Oct 18, 2011)
- 3: IctoanAWEWawi (Oct 18, 2011)
- 4: TRiG (Ireland) A dog, so bade in office (Oct 25, 2011)
- 5: You can call me TC (Oct 25, 2011)
- 6: dElaphant (and Zeppo his dog (and Gummo, Zeppos dog)) - Left my apostrophes at the BBC (Oct 26, 2011)
- 7: six7s (Oct 26, 2011)
- 8: six7s (Oct 27, 2011)
- 9: You can call me TC (Oct 27, 2011)
- 10: aka Bel - A87832164 (Oct 27, 2011)
- 11: six7s (Oct 27, 2011)
More Conversations for New h2g2 Feedback
Write an Entry
"The Hitchhiker's Guide to the Galaxy is a wholly remarkable book. It has been compiled and recompiled many times and under many different editorships. It contains contributions from countless numbers of travellers and researchers."