should fix #1364 and added relevant unit test cases for this bug (yeah for unit tests)

git-svn-id: http://code.elgg.org/elgg/trunk@3676 36083f99-b078-4883-b0ff-0f9b5a30f544

2 files changed, 14 insertions, 2 deletions

diff --git a/engine/lib/api.php b/engine/lib/api.php
index 46b3e0e40..bed7a5129 100644
--- a/engine/lib/api.php
+++ b/engine/lib/api.php
@@ -634,7 +634,7 @@ function serialise_parameters($method, $parameters) {
 				
 				break;
 			case 'string': 
-				$serialised_parameters .= ",'" .  (string)mysql_real_escape_string(trim($parameters[$key])) . "'"; 
+				$serialised_parameters .= ",'" . addcslashes(trim($parameters[$key]), "'") . "'";
 				break;
 			case 'float': 
 				$serialised_parameters .= "," . (float)trim($parameters[$key]); 
diff --git a/engine/tests/services/api.php b/engine/tests/services/api.php
index 28a7a64bc..57aaa08d5 100644
--- a/engine/tests/services/api.php
+++ b/engine/tests/services/api.php
@@ -81,10 +81,10 @@ class ElggCoreServicesApiTest extends ElggCoreUnitTest {
 		$parameters = array('param1' => array('type' => 'int', 'required' => true), 

 							'param2' => array('type' => 'bool', 'required' => true),

 							'param3' => array('type' => 'string', 'required' => false), );

+		$method['description'] = '';

 		$method['function'] = 'foo';

 		$method['parameters'] = $parameters;

 		$method['call_method'] = 'GET'; 

-		$method['description'] = '';

 		$method['require_api_auth'] = false;

 		$method['require_user_auth'] = false;

 

@@ -224,6 +224,18 @@ class ElggCoreServicesApiTest extends ElggCoreUnitTest {
 		$s = serialise_parameters('test', $parameters);

 		$this->assertIdentical($s, ",'testing'");

 

+		// test string with " in it

+		$this->registerFunction(false, false, array('param1' => array('type' => 'string')));

+		$parameters = array('param1' => 'test"ing');

+		$s = serialise_parameters('test', $parameters);

+		$this->assertIdentical($s, ',\'test"ing\'');

+		

+		// test string with ' in it

+		$this->registerFunction(false, false, array('param1' => array('type' => 'string')));

+		$parameters = array('param1' => 'test\'ing');

+		$s = serialise_parameters('test', $parameters);

+		$this->assertIdentical($s, ",'test\'ing'");

+		

 		// float

 		$this->registerFunction(false, false, array('param1' => array('type' => 'float')));

 		$parameters = array('param1' => 2.5);