DB quoting of some statements - Joomla! Forum - community, help and support

hi

i have following function in mycomponentmodeluser:

code: select all

function geteditformuser($uid)
{
   // set query
   $query = "select `uid`, `username`, u.name, `organisation`, `grpid`".
         " ".$this->_db->namequote('#__lighthouse_user')." ".$this->_db->namequote('lu').
          " inner join ".$this->_db->namequote('#__users')." ".$this->_db->namequote('u').
         //" on ".$this->_db->namequote('lu.uid')." = ".$this->_db->namequote('u.id').
         " on lu.uid = u.id";
         " ".$this->_db->namequote('uid')." = ".$this->_db->quote((int)$uid);
   $this->_db->setquery($query);

   return $this->_db->loadobject();
}

which executed under many joomla versions.

if change commented line below:

code: select all

function geteditformuser($uid)
{
   // set query
   $query = "select `uid`, `username`, u.name, `organisation`, `grpid`".
         " ".$this->_db->namequote('#__lighthouse_user')." ".$this->_db->namequote('lu').
          " inner join ".$this->_db->namequote('#__users')." ".$this->_db->namequote('u').
         " on ".$this->_db->namequote('lu.uid')." = ".$this->_db->namequote('u.id').
         //" on lu.uid = u.id";
         " ".$this->_db->namequote('uid')." = ".$this->_db->quote((int)$uid);
   $this->_db->setquery($query);

   return $this->_db->loadobject();
}

the function fails example in joomla 1.5.7 version (the problem in quoting u.id , lu.uid fields)

so question - should quote table fields or values, want pass db queries , table names (#__lighthouse_user')? should quote finally?

kostya

i think problem lies in once table aliased, no longer direct db object, alias understood sql. surprised :

code: select all

$this->_db->namequote('lu')

works @ all, since there no 'lu' point @ in original object, it's sql alias.

once alias table, write straight sql:

code: select all

.$this->_db->namequote('#__lighthouse_user')." lu ..."

it works fine me way. this:

code: select all

" on ".$this->_db->namequote('lu.uid')."

becomes simply:

code: select all

" on lu.uid ="

this know works , makes logical sense ( @ least me...)
perhaps 1 of moderators can chime in if not correct way...