database error message(FIXED)

[ncangler]

I received several error messages this morning like the one below. Any idea what would cause this? Thanks.

An error was encountered during execution of the query:

SELECT id,catname,template FROM class_categories WHERE id=2forums/images/buttons/collapse_tcat.gif

The query returned with an errorcode of:

Unknown column '2forums' in 'where clause'

[Chuck S]

well I would like to know how the query is running for one. Notice the wrap saying is_numeric($cat) well thats definitely not a numeric cat.

elseif ( is_numeric($cat) ) {
$query = "SELECT id,catname,template FROM {$Globals['pp_db_prefix']}categories WHERE id=$cat";
$ctitleq = ppmysql_query($query, $link);
if ( $ctitleq ) {
list( $catid, $thecatname, $Globals['cattemp'] ) = mysql_fetch_row($ctitleq);
}

I would not worry probally an quirk but I do the query is properly sanitized. $cat is ran through the typecast function and there is even a constraint phrase to only run this query is cat is numeric

[ncangler]

I have no idea where this came from. The assumption is that someone was in the PHoto Gallery and clicked on something that generated the error message to me. I had about a dozen of them in the inbox this morning.

[Chuck S]

Okay most likely a spider. I dont see how that query would run still.

You can do this though

WHERE id='$cat'"; just encapsulate $cat like so '$cat' and you will not get the errors

[ncangler]

Where do I make that change? Do you think it is necessary or should I just forget it? Thanks Chuck!

[Chuck S]

You dont have to make it as I think this is a spider doing it but it still boggles my mind how that cat string is getting past the php internal is_numeric clause we use to only run that query if cat is numeric. You can surpress the error by encapsulating the variable which means this

In the query meantioned just make WHERE id=$cat to WHERE id='$cat'