rbrandon [rbrandon] [#530208]

CVS edit link for rbrandon

I am employed by a group that is starting a drupal centered project. This will require some additional features that drupal does not currently have available. We are happy to let everyone enjoy in the fruits of our labor.

The first module I will be submitting is an extension of CCK (as if it needed another), however it's functionality does not already exist. It is a module that allows the addition of arbitrary key / value pairs to a node. The key has an autocomplete to cut down on duplicate values. First module was simple, and I am sure more complicated will come.

You can view the source at: http://scholar-dev1.iq.harvard.edu/dyntextfield.zip

Take Care,
Richard Brandon

Comment	File	Size	Author
#1	dyntextfield.zip	14.12 KB	rbrandon

Comments

Comment #1

rbrandon commented 24 July 2009 at 19:42

Status	File	Size
new	dyntextfield.zip	14.12 KB

Comment #2

ajk commented 24 July 2009 at 19:45

Status:

Postponed (maintainer needs more info)

» Closed (won't fix)

As with you last application:-

  $result = db_query("SELECT DISTINCT {$s_table_name}_label as label FROM {content_{$s_table_name}} WHERE {$s_table_name}_label LIKE '%s' ORDER BY {$s_table_name}_label DESC LIMIT 20 ", $s_prefix."%");

is an SQL injection problem because the buried vars come directly from user input without you filtering them with filtering them.

See http://api.drupal.org/api/function/db_escape_table/6 and Writing Secure Code.