Infrequent but steady stream of database errors after upgrade

[eschaum]

Hi,

I'm getting some recurring database errors after upgrading to rc3.

The first might be related to users having an apostrophe in their user name. Here are 2 sample error messages:
*************************
Database error in vBulletin 3.5.0 Release Candidate 3:

Invalid SQL:

SELECT posts, userid, username FROM user AS user
WHERE username = 'Greenglade's Frog';

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Frog'' at line 2
Error Number : 1064
Date : Wednesday, September 14th 2005 @ 01:47:05 AM
Script : http://forum.yestalk.org/search.php?do=process&showposts=0&starteronly=1&exactname=1&searchuser=Greenglade\'s+Frog
Referrer :
IP Address : 65.19.150.227
Username : Unregistered
Classname : vb_database
*************************
Database error in vBulletin 3.5.0 Release Candidate 3:

Invalid SQL:

SELECT posts, userid, username FROM user AS user
WHERE username = 'Roan's Lady';

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Lady'' at line 2
Error Number : 1064
Date : Tuesday, September 13th 2005 @ 11:42:32 PM
Script : http://forum.yestalk.org/search.php?do=process&showposts=0&starteronly=1&exactname=1&searchuser=Roan\'s+Lady
Referrer :
IP Address : 65.19.150.227
Username : Unregistered
Classname : vb_database
************************


Edit: The error listed below is likely from my host, they are reporting packet dropping problems with their routers.

The second error is a not so specific, and could be something with my host, but I'm not sure:

Database error in vBulletin :

mysql_connect(): Lost connection to MySQL server during query
/home/.hadrondryer/afterhrs/forum.yestalk.org/includes/class_core.php on line 265

MySQL Error :
Error Number :
Date : Wednesday, September 14th 2005 @ 10:08:25 AM
Script : http://forum.yestalk.org/attachment....1&d=1123616716
Referrer : http://forum.yestalk.org/showthread.php?t=5405
IP Address : 4.20.178.68
Username :


Classname : vb_database
I normally wouldn't report a connection lost error, but I have dozens of these error messages and they all make reference to class_core.php on line 265.


Any ideas what might be happening here?

Thanks,

Ed

[Steve Machol]

The first thing I recommend is that you reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server.

Next, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it. Do you have the same problem?

The second error is a server issue. You need to contact your host about this. See this post for the possible causes of a lost connection error:

http://www.vbulletin.com/forum/showthread.php?s=&postid=310265#post310265

[Mike Sullivan]

The first issue is a known and recently fixed bug.

[eschaum]

The first issue is a known and recently fixed bug.

Thanks, I was getting worried that something went wrong during the upgrade.

Ed

[Paul]

Hi Ed,

I reported the bug you listed here this morning after receiving a similar report yesterday, however it appears the bug is no longer viewable in the bug tracker. You'll note that both usernames contain apostrophes. Essentially, the username passed onto search when "exact match" is selected isn't properly prepped for the query to the database server and the apostrophes aren't backslashed (\'). In general, this sort of checking failure is a very bad thing in terms of nasty things that can be done by someone acting maliciously.

The change I've made to prevent this problem is quite simple, however I don't know if the same issue appears in other parts of the code (I certainly hope not!):

Open search.php and find the following line (part of a SELECT query):

WHERE username " . iif($vbulletin->GPC['exactname'], "= '$username'", "LIKE('%" . sanitize_word_for_sql($username) . "%') 

Replace it with the following:

WHERE username " . iif($vbulletin->GPC['exactname'], "= '" . sanitize_word_for_sql($username) . "'", "LIKE('%" . sanitize_word_for_sql($username) . "%') 

I have no idea if this appeared in earlier versions, but I only noticed it in 3.5 RC3. I very highly recommend that anyone running vBulletin 3.x check for the existance of the flawed code above and quickly implement this fix.

Best wishes,
Paul

[majorxp]

The code in question was changed from RC2 to RC3... I would like to hear the official word as if Paul's revert to RC2 code is a good recommendation.


RC2

        $username = sanitize_word_for_sql(htmlspecialchars_uni($vbulletin->GPC['searchuser']));
.
.
            WHERE username " . iif($vbulletin->GPC['exactname'], "= '$username'", "LIKE('%$username%')

RC3

        $username = htmlspecialchars_uni($vbulletin->GPC['searchuser']);
.
.
            WHERE username " . iif($vbulletin->GPC['exactname'], "= '$username'", "LIKE('%" . sanitize_word_for_sql($username) . "%')