From e61c9b866e187858393e52797b314011d42d7bc9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Elan=20Ruusam=C3=A4e?= <glen@delfi.ee>
Date: Thu, 9 May 2013 13:59:29 +0300
Subject: [PATCH] escape custom field columns properly

this allows custom field values like "foo-bar", i.e not to create
substraction expression.
---
 lib/eventum/class.search.php | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/lib/eventum/class.search.php b/lib/eventum/class.search.php
index c6c8ef6..818b6bc 100644
--- a/lib/eventum/class.search.php
+++ b/lib/eventum/class.search.php
@@ -281,10 +281,10 @@ public static function getListing($prj_id, $options, $current_row = 0, $max = 5)
                 if ($field['fld_type'] == 'multiple') {
                     $search_value = Misc::escapeString($search_value);
                     foreach ($search_value as $cfo_id) {
-                        $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as cf" . $fld_id . '_' . $cfo_id . "\n";
+                        $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as `cf" . $fld_id . '_' . $cfo_id . "`\n";
                     }
                 } else {
-                    $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as cf" . $fld_id . "\n";
+                    $stmt .= ",\n" . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field as `cf" . $fld_id . "`\n";
                 }
             }
         }
@@ -621,17 +621,17 @@ public static function buildWhereClause($options)
                     $search_value = Misc::escapeString($search_value);
                     foreach ($search_value as $cfo_id) {
                         $cfo_id = Misc::escapeString($cfo_id);
-                        $stmt .= " AND\n cf" . $fld_id . '_' . $cfo_id . ".icf_iss_id = iss_id";
-                        $stmt .= " AND\n cf" . $fld_id . '_' . $cfo_id . ".icf_fld_id = $fld_id";
-                        $stmt .= " AND\n cf" . $fld_id . '_' . $cfo_id . "." . $fld_db_name . " = '$cfo_id'";
+                        $stmt .= " AND\n `cf" . $fld_id . '_' . $cfo_id . "`.`icf_iss_id` = iss_id";
+                        $stmt .= " AND\n `cf" . $fld_id . '_' . $cfo_id . "`.`icf_fld_id` = $fld_id";
+                        $stmt .= " AND\n `cf" . $fld_id . '_' . $cfo_id . "`.`" . $fld_db_name . "` = '$cfo_id'";
                     }
                 } elseif ($field['fld_type'] == 'date') {
                     if ((empty($search_value['Year'])) || (empty($search_value['Month'])) || (empty($search_value['Day']))) {
                         continue;
                     }
                     $search_value = $search_value['Year'] . "-" . $search_value['Month'] . "-" . $search_value['Day'];
-                    $stmt .= " AND\n (iss_id = cf" . $fld_id . ".icf_iss_id AND
-                        cf" . $fld_id . "." . $fld_db_name . " = '" . Misc::escapeString($search_value) . "')";
+                    $stmt .= " AND\n (iss_id = `cf" . $fld_id . "`.icf_iss_id AND
+                        `cf" . $fld_id . "`.`" . $fld_db_name . "` = '" . Misc::escapeString($search_value) . "')";
                 } else if ($field['fld_type'] == 'integer') {
                     $value = $search_value['value'];
                     switch ($search_value['filter_type']) {
@@ -651,16 +651,16 @@ public static function buildWhereClause($options)
                         $cmp = '=';
                         break;
                     }
-                    $stmt .= " AND\n (iss_id = cf" . $fld_id . ".icf_iss_id";
-                    $stmt .= " AND\n cf" . $fld_id . ".icf_fld_id = $fld_id";
+                    $stmt .= " AND\n (iss_id = `cf" . $fld_id . "`.icf_iss_id";
+                    $stmt .= " AND\n `cf" . $fld_id . "`.icf_fld_id = $fld_id";
                     $stmt .= " AND cf" . $fld_id . "." . $fld_db_name . $cmp . Misc::escapeString($value) . ')';
                 } else {
-                    $stmt .= " AND\n (iss_id = cf" . $fld_id . ".icf_iss_id";
-                    $stmt .= " AND\n cf" . $fld_id . ".icf_fld_id = $fld_id";
+                    $stmt .= " AND\n (iss_id = `cf" . $fld_id . "`.icf_iss_id";
+                    $stmt .= " AND\n `cf" . $fld_id . "`.icf_fld_id = $fld_id";
                     if ($field['fld_type'] == 'combo') {
-                        $stmt .= " AND cf" . $fld_id . "." . $fld_db_name . " IN(" . join(', ', Misc::escapeInteger($search_value)) . ")";
+                        $stmt .= " AND `cf" . $fld_id . "`.`" . $fld_db_name . "` IN(" . join(', ', Misc::escapeInteger($search_value)) . ")";
                     } else {
-                        $stmt .= " AND cf" . $fld_id . "." . $fld_db_name . " LIKE '%" . Misc::escapeString($search_value) . "%'";
+                        $stmt .= " AND `cf" . $fld_id . "`.`" . $fld_db_name . "` LIKE '%" . Misc::escapeString($search_value) . "%'";
                     }
                     $stmt .= ')';
                 }
-- 
1.8.4

