By kris digital on

Hi,

I just realized that when I made this query

$result = db_query("SELECT uid FROM {profile_values} WHERE fid = 20 AND value=%d", $uid);

and $uid is 100000479628328, it doesn't work because the number is too big. Even %f won't work. Now I do it like

$result = db_query("SELECT uid FROM {profile_values} WHERE fid = 20 AND value=".$uid);

Is this a bug?

⋅ Categories: Drupal 5.x

Comments

gpk’s picture

gpk commented

>Is this a bug?
Not really, No one would have envisaged having that many users on a site. If you want to avoid possibly security holes arising from stuffing $uid directly into the query you could try using '%s'. Otherwise be very careful that $uid really is just a number.

gpk
----
www.alexoria.co.uk

shadcn’s picture

shadcn commented

This ,100000479628328, is way pass the range available for %d.

kris digital’s picture

kris digital commented

thanks for your comments, it's actually not our users but facebook's... I'll give %s a shot!