[nextgen-gallery] Fix identifiers quoted as strings
MySQL allows quoting identifiers, such as column names, as strings using
single-quotes in addition to quoting as identifiers using grave accents.
PostgreSQL does not, resulting in errors such as:
Error running :
SELECT DISTINCT wp_ngg_pictures.* , GROUP_CONCAT(CONCAT_WS('@@', meta_key, meta_value)) AS 'extras' FROM `wp_ngg_pictures` LEFT OUTER JOIN `wp_postmeta` ON `wp_postmeta`.`post_id` = `extras_post_id` GROUP BY wp_ngg_pictures.pid LIMIT 1
---- converted to ----
SELECT DISTINCT wp_ngg_pictures.* , GROUP_CONCAT(CONCAT_WS('@@', meta_key, meta_value)) AS 'extras' FROM wp_ngg_pictures LEFT OUTER JOIN wp_postmeta ON wp_postmeta.post_id = extras_post_id GROUP BY wp_ngg_pictures.pid LIMIT 1
----> ERROR: syntax error at or near "'extras'"
LINE 1: ..._CONCAT(CONCAT_WS('@@', meta_key, meta_value)) AS 'extras' F...
^
Fix this by replacing single quotes with grave accents when they occur
after ") AS ". This strategy obviously has both false-positive and
false-negative issues, but suits the current needs and should be
relatively safe from false-positives. Proper replacement would require
parsing the SQL.
Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
This commit is contained in:
@@ -292,6 +292,11 @@
|
||||
if( false !== strpos( $sql, $wpdb->comments))
|
||||
$sql = str_replace(' comment_id ', ' comment_ID ', $sql);
|
||||
|
||||
// MySQL supports strings as names, PostgreSQL needs identifiers.
|
||||
// Limit to after closing parenthesis to reduce false-positives
|
||||
// Currently only an issue for nextgen-gallery plugin
|
||||
$pattern = '/\) AS \'([^\'])\'/';
|
||||
$sql = preg_replace( $pattern, ') AS "$1"', $sql);
|
||||
} // SELECT
|
||||
elseif( 0 === strpos($sql, 'UPDATE'))
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user