[TYPO3-dev] Problem with sql query

[Stefan Kreisberg]

Stefan Bothner | [m]zentrale wrote:

> Hi Brian,
> 
> if you have spaces within this value you have to
> rewrite the query like this:
> 
>
GLOBALS['TYPO3_DB']->SELECTquery('*','tx_boligtilbud_acceptet_offers','casei
> d=\''.$this->piVars['sagsnummer'].'\'
> AND user_id='.$this->piVars['userid'].'');
> 
> sagsnummer is not integer so you have to set the value into '.
> 
> Kind regards
> 
> Stefan

And you should probably do some more variable checking to secure your
queries: take a look at quoteStr method in the DB API and if you know
user_id is int then intval it, i.e.:

  AND user_id='.intval($this->piVars['userid']).'');

Best of luck!

-Stefan a.k.a. Strato

> 
>> -----Original Message-----
>> From: typo3-dev-bounces at lists.netfielders.de
>> [mailto:typo3-dev-bounces at lists.netfielders.de] On Behalf Of
>> Brian Bendtsen
>> Sent: Tuesday, June 20, 2006 9:54 AM
>> To: typo3-dev at lists.netfielders.de
>> Subject: Re: [TYPO3-dev] Problem with sql query
>> 
>> Brian Bendtsen wrote:
>> > Hi
>> > 
>> > First of all I have this select statement in an extension I
>> have developed:
>> > 
>> > $query =
>> > 
>> GLOBALS['TYPO3_DB']->SELECTquery('*','tx_boligtilbud_acceptet_
> offers','caseid='.$this->piVars['sagsnummer'].'
>> > AND user_id='.$this->piVars['userid'].'');
>> > $res = $GLOBALS['TYPO3_DB']->sql(TYPO3_db, $query);
>> > 
>> > if(!mysql_num_rows($res)==0) {
>> >               Do something...
>> > }
>> > 
>> > I suddenly get this error:
>> > 
>> > Warning: mysql_num_rows(): supplied argument is not a valid MySQL
>> > result resource in
>> > 
>> D:\Domains\initaaq.gl\wwwroot\typo3\typo3conf\ext\boligtilbud\pi1\clas
>> > s.tx_boligtilbud_pi1.php
>> > on line 56
>> > 
>> > Another thing. I have showphperrors set to 0 in the install
>> tool. They
>> > shouldnt be displayed should they?
>> > 
>> > Im using typo3 3.8.1
>> > 
>> > /Brian Bendtsen
>> 
>> Hi again
>> 
>> I found out that the caseid's was initially like this
>> "124578" but when you change it to "12 45 78" the error
>> appears. The caseid field is defined as a tinytext. How do I
>> solved this? Can I make it work with the spaces?
>> 
>> My php skills are very low
>>  
>>  
>> 
>> 
>> /Brian Bendtsen
>> _______________________________________________
>> TYPO3-dev mailing list
>> TYPO3-dev at lists.netfielders.de
>> http://lists.netfielders.de/cgi-bin/mailman/listinfo/typo3-dev
>>