Error splitting a thread

[jhames]

I just tried splitting a thread for the first time and got this error:

You have an error in your SQL syntax near 'Inservices' WHERE ID_MSG=75 AND ID_TOPIC=31' at line 1
File: D:\InetPub\wwwroot\Forum\Sources\SplitThreads.php
Line: 187

I am going to look into it a little deeper, but I thought that someone here might have some information.

Thanks!

Joel

[jhames]

I just realized that the thread was split, despite getting this error.  I am still a little concerned, though...

-Joel

[David]

Just a guess but maybe the subject had a ' in it?

[[Unknown]]

This is indeed a bug.... the subject is not being escaped.

-[Unknown]

[[Unknown]]

Sources/SplitThreads.php

Find:
$result = mysql_query("UPDATE {$db_prefix}messages SET subject='$subname' WHERE ID_MSG=$at AND ID_TOPIC=$split2_topicID") or database_error(__FILE__, __LINE__);

Replace:
$result = mysql_query("UPDATE {$db_prefix}messages SET subject='" . addslashes($subname) . "' WHERE ID_MSG=$at AND ID_TOPIC=$split2_topicID") or database_error(__FILE__, __LINE__);

Find:
$result = mysql_query("UPDATE {$db_prefix}messages SET ID_TOPIC=$split2_topicID,subject='$subname' WHERE ID_TOPIC=$split1_topicID AND ID_MSG IN ($postList)") or database_error(__FILE__, __LINE__);

Replace:
$result = mysql_query("UPDATE {$db_prefix}messages SET ID_TOPIC=$split2_topicID,subject='" . addslashes($subname) . "' WHERE ID_TOPIC=$split1_topicID AND ID_MSG IN ($postList)") or database_error(__FILE__, __LINE__);

-[Unknown]

[jhames]

It worked perfectly..

Thanks again!

Joel