There is an incoherent mode of using query arguments in the handlers/views_handler_filter_string.inc that happens to work on mysql but is not logically correct. I will use the op_contains function as an example but the bug applies to many other functions:

Actually the function looks like this:

function op_contains($field, $upper) {
$this->query->add_where($this->options['group'], "$upper(%s) LIKE $upper('%%%s%%')", $field, $this->value);
}

The fact is that $field is for example "node.title" so it is not an argument but part of the query (a table column)...
This happens to work on mysql because the current implementation of variable binding in the MySQL driver is to
replace values directly in the query... So the final query looks like this:

select * from node where upper(node.title) like '%myval%'

where other implementation like pgsql or oracle will have:

select * from node where upper(:bind1) like '%'||:bind2||'%' args('node.title','myval')

that obviuosly will not return correct values...

the correct implementation should be this (IMUO):

function op_contains($field, $upper) {
$this->query->add_where($this->options['group'], "$upper($field) LIKE $upper('%%%s%%')", $this->value);
}

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

dawehner’s picture

If you have a patch, its always better to use.

aaaristo’s picture

Status: Active » Needs review
FileSize
2.15 KB

proposed patch.

dawehner’s picture

FileSize
3.35 KB

Here is first a rerole for 3.x, i thought the new methods are also in 2.x. So this patch still stays on NR.

I tryed something around 6/7 possible operators, and all works fine.

dawehner’s picture

I also reviewed just the code, it looked fine.

dawehner’s picture

I also reviewed just the code, it looked fine.

dawehner’s picture

So new version for both branches

merlinofchaos’s picture

Status: Needs review » Fixed

Committed to D6-2.x and D6-3.x -- I don't think this is going to be an issue for D7 at all, since placeholders probably already had to be fixed there.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.