customer or company name include apostrophe will cuase error??

[kappa525ny]

Hi,

 

I don't know why when customer creat account and

the first , last name or company name include apostrophe will cuase error during check out process??

 

The error appear in the file below :

http://www.uniquepacking.com/checkout_process.php

 

Error msg:

1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's store', '133-33 st', '', 'flushing', '11354', 'Alabama', 'United States', '135' at line 1

 

insert into orders (customers_id, customers_name, customers_company, customers_street_address, customers_suburb, customers_city, customers_postcode, customers_state, customers_country, customers_telephone, customers_email_address, customers_address_format_id, delivery_name, delivery_company, delivery_street_address, delivery_suburb, delivery_city, delivery_postcode, delivery_state, delivery_country, delivery_address_format_id, billing_name, billing_company, billing_street_address, billing_suburb, billing_city, billing_postcode, billing_state, billing_country, billing_address_format_id, payment_method, cc_type, cc_owner, cc_number, cc_expires, date_purchased, orders_status, currency, currency_value) values ('584', 'chi kuo', 'chi's store', '133-33 st', '', 'flushing', '11354', 'Alabama', 'United States', '1354725-554', '[email protected]', '2', 'chi kuo', 'chi's store', '133-33 st', '', 'flushing', '11354', 'Alabama', 'United States', '2', 'chi kuo', 'chi's store', '133-33 st', '', 'flushing', '11354', 'Alabama', 'United States', '2', 'Check/Money Order', '', '', '', '', now(), '9', 'USD', '1.00000000')

 

 

anyone have any idea how and why this happened? and how do I fix this porblem??

 

 

Thank you.

[krdito]

I have the same problem, although the customer does not seem to receive the error message when entering their info with an apostrophe when creating an account or placing an order.

 

When I see an apostophe, I just replace it with the "apostrophe-like" character ( ` ) on the top left row of the keyboard, on the same key as the ~ symbol

[Jack_mcs]

I don't know why when customer creat account and

the first , last name or company name include apostrophe will cuase error during check out process??

 

anyone have any idea how and why this happened? and how do I fix this porblem??

It;s happening because the apostrophe is a special character in php. If it used in text, the php parser has to be told not to treat it as a php character. To do that, you need to find the database command and surround the fileds that might contain them with addslashes(). The correct way to do it in oscommerce is to use the tep_db_prepare_input and tep_db_input functions. Check files like create_account.php to see the usage or post the code in question here and someone will probably help with it.