From 043f9e92484bdd04c149f8fbc3eb3803fb1f4e00 Mon Sep 17 00:00:00 2001 From: Beshoy Girgis Date: Mon, 11 Jan 2021 11:42:56 -0600 Subject: [PATCH] Escape Message-ID during update binaries I ran misc/update/update_binaries.php manually because I noticed a lot of missing parts that weren't going away and noticed sql errors on the INSERT IGNORE. It turns out that some of the message IDs had single quotes in them that inhibited the query from executing properly. An example I found is: 200420092300004385%But-i-really@dont'care.com (oddly enough, the single quote isn't in the word don't, but after...) semi-sanitizing the data through the `addslashes` function takes care of the problem -- I'm not aware if there's a more elegant method of sanitizing that is available. Please let me know if there is and I'll update. --- Blacklight/Binaries.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Blacklight/Binaries.php b/Blacklight/Binaries.php index 94675c967..194f62bcf 100755 --- a/Blacklight/Binaries.php +++ b/Blacklight/Binaries.php @@ -895,6 +895,9 @@ class Binaries $binariesUpdate[$binaryID]['Parts']++; } + // In case there are quotes in the message id + $this->header['Message-ID'] = addslashes($this->header['Message-ID']); + // Strip the < and >, saves space in DB. $this->header['Message-ID'][0] = "'";