0

I have a website that allows users to upload pictures. To reduce the amount of space used by pictures files on my site, I attempted to use a script to remove orphaned files. However, this script chokes on Unicode file names; there are dozens of pictures with Unicode file names on my site:

query:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 's Adorable Kitty EDIT.jpg'' at line 1

I have enabled the Transliteration module so that new files will not have this problem. However, what can I do about the old files? Is there a way to change their names and update the Drupal DB? I am willing to do this manually if necessary, but I don't know how to approach this.

EDIT: Upon closer inspection, the problem is not unicode, it's the quote marks in the filename.

1

As far as I am able to tell, the script works OK with Unicode.

But the script doesn't sanitize the file names, and that is what invalidates the query.

It could be a a lot worse. If somebody uploads an image named image'); DROP TABLE *;--.jpg, and you use that script, they would erase your site (as shown in the XKCD cartoon below):

enter image description here

Source: xkdc - Exploits of a mom

I would strongly advice postponing the use of that script until somebody who understands database security has cleaned it up.

Suggestion: hand edit the file names with quotes in them by removing the quotes, and edit the corresponding names in table file_managed.

I am also puzzled that the Drupal file upload module does not sanitize file names by not permitting quotes in file names.

| improve this answer | |
  • Thanks, I was able to get it working by editing the filenames manually. – Patrick Kenny Apr 9 '13 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.