Description

If a column is named group and drupal_write_record called, explicitly setting this column, the INSERT-operation will fail, because MySQL interprets the column name as the keyword GROUP (the same could be true for other keywords).

Proposed bugfix

This could be fixed by either disallowing keywords in column names (in the construction of tables) or by escaping column names with `. (I have not tested the latter for systems other then MySQL).

System used

Debian Linux (etch) with Apache 2.2.3-4, PHP 5.2.0-8 and MySQL 5.0.32. The bug occurs on Drupal 6 and 7, untested for other versions.

The attached patch contains a short (but not very nice) bugfix to proof that "`" actually works.

CommentFileSizeAuthor
core.writeRecord.patch604 bytesAnonymous (not verified)

Comments

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Component: base system » database system

Moving to the database queue. I did a quick test and can confirm that this is still an issue.

damien tournoud’s picture

damien tournoud commented
Status: Active » Closed (won't fix)

You are supposed not to use reserved words.

Anonymous’s picture

Anonymous (not verified) commented

True. The problem arose in a module I took over - wouldnt have done that myself. But this is in fact a problem with a database-independent CMS. Maybe one word is reserved in one database and not in another?
Why not forbid those words by default?