Fix #13280: Incorrect queries logged when sorting by custom field having accented chars

dregad · dregad · commit 5835572fde9d · 2011-09-09T09:23:01.000+02:00
The offsets returned by preg_match are byte-based, which causes issues with
UTF-8 characters as the subsequent calls to utf8_substr operate on the wrong
part of the string; this results in logging of invalid SQL queries when
$g_show_queries_list = ON.

This commit fixes the problem by realigning the offsets prior to performing the
query parameter substitution.

It also simplifies the code by removing parenthesis in the regexp pattern,
which is not necessary since we are only matching a single element, this way
there is no need to deal with a multi-dimentional array.
diff --git a/core/database_api.php b/core/database_api.php
@@ -346,7 +346,12 @@ function db_query_bound( $p_query, $arr_parms = null, $p_limit = -1, $p_offset =
 		$lastoffset = 0;
 		$i = 1;
 		if( !( is_null( $arr_parms ) || empty( $arr_parms ) ) ) {
-			while( preg_match( '/(\?)/', $p_query, $matches, PREG_OFFSET_CAPTURE, $lastoffset ) ) {
+			while( preg_match( '/\?/', $p_query, $matches, PREG_OFFSET_CAPTURE, $lastoffset ) ) {
+				$matches = $matches[0];
+				# Realign the offset returned by preg_match as it is byte-based,
+				# which causes issues with UTF-8 characters in the query string
+				# (e.g. from custom fields names)
+				$matches[1] = utf8_strlen( substr( $p_query, 0, $matches[1]), mb_internal_encoding() );
 				if( $i <= count( $arr_parms ) ) {
 					if( is_null( $arr_parms[$i - 1] ) ) {
 						$replace = 'NULL';
@@ -370,10 +375,10 @@ function db_query_bound( $p_query, $arr_parms = null, $p_limit = -1, $p_offset =
 						echo( "Invalid argument type passed to query_bound(): $i" );
 						exit( 1 );
 					}
-					$p_query = utf8_substr( $p_query, 0, $matches[1][1] ) . $replace . utf8_substr( $p_query, $matches[1][1] + utf8_strlen( $matches[1][0] ) );
-					$lastoffset = $matches[1][1] + utf8_strlen( $replace );
+					$p_query = utf8_substr( $p_query, 0, $matches[1] ) . $replace . utf8_substr( $p_query, $matches[1] + utf8_strlen( $matches[0] ) );
+					$lastoffset = $matches[1] + utf8_strlen( $replace );
 				} else {
-					$lastoffset = $matches[1][1] + 1;
+					$lastoffset = $matches[1] + 1;
 				}
 				$i++;
 			}
