FrontAccounting forum — Import CSV Items

Re: Import CSV Items

null@example.com (joe) — Mon, 08 Sep 2008 11:52:38 +0000

Your solution is perfect.

/Joe

Re: Import CSV Items

null@example.com (roger) — Mon, 08 Sep 2008 11:36:53 +0000

Is the solution I used correct or does it cause any risks/issues?

Re: Import CSV Items

null@example.com (joe) — Mon, 08 Sep 2008 07:11:48 +0000

We are aware of this problem. We had to escape all the input database fields in FrontAccounting to eliminate spammer injections. Spammers could add html code into the fields and thereby inject the script.

/Joe

Re: Import CSV Items

null@example.com (roger) — Mon, 08 Sep 2008 02:40:12 +0000

Hi Joe,
I check the module and found an error:
On line 38 you use db_escape() function to clean the $description field. This results in the addition of single quotes arround the quotes in $description.
Later in line 67 and 85 when building the SQL statements for update and insert there is yet an other sigle quote arround %description resulting in a SQL error.

Removing these quotes seams to solve the problem.

Regards

Roger

Import CSV Items

null@example.com (joe) — Thu, 06 Dec 2007 21:23:21 +0000

A module for importing Items from other systems has been added to the Download pages.

/Joe