PHP Warning: mysql_num_rows():

[Oliver341]

Right. I've been doing some more digging into the problem which gave me the:

[Mon May 10 02:10:07 2004] [error] PHP Warning: Cannot modify header information - headers already sent by (output started at /home/celebrit/public_html/stats2/libraries/functions.lib.php:493) in /home/celebrit/public_html/stats2/pphlogger.php on line 226
[Mon May 10 02:10:07 2004] [error] PHP Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/celebrit/public_html/stats2/libraries/functions.lib.php on line 493

errors in my error logfile.

The problem occurs when someone is referred to my site from a search engine when " or ' is used in the search keyword. This has the effect of ruining the mysql query string, which means the mysql query is messed up, which means mysql_num_rows() does not get a valid database result to work with, which then produces the above error.

" is turned into \ by the keyword parsing code, and when this is at the END of a keyword query it has the effect of escaping the closing quote of the mysql database query string.
' is not removed by the keyword parsing code at all and obviously will close the quotes prematurely in a mysql query string.

I have cured this problem in my own copy of pphlogger by adding another stripslashes to remove the extra \ and by adding another ereg_replace to get rid of the ' character. I have not seen the error message since I did this.

I hope this information helps to fix this bug.

Oliver.

[sdjl]

Would you mind posting the code you change in each of the files?
Explaining the problem is fantastic, but a lot of people would love to see some code to copy and paste over.

It would also save Philip from having to make edits for the big fix.

Thanks for looking into this, it's much appreciated.

David

[Oliver341]

[sdjl]

[Sergio]