mysqli_real_escape_string() warning on 'Next' when multiselect used

[MichaelRLevy]

We're using Version 6.4.0beta2 (Build 7080) with a number of custom modules.

Two modules have a multiselect fields with more than 20 records, and both exhibit this problem. When doing a basic search, if any of the multiselect fields have any value selected to limit the search, the first page of 20 results works fine. However, upon clicking the 'Next' arrow, the message below is displayed, and the search results display as if none of the multiselect values were selected -- in other words, the search is limited by any text entry fields or dropdown field that was selected, but the multiselect value becomes unselected.

This message is displayed on the page above the word 'Search'

Warning: mysqli_real_escape_string() expects parameter 2 to be string, array given in /data/sites/apps/public/dctrack/include/database/MysqliManager.php on line 238

sugarcrm.log has lines such as this:

Tue Nov 29 11:42:09 2011 [7451][9cc773a7-9b70-7d53-40fd-4eb2c7d22713][DEPRECATED] SugarBean.php: preprocess_fields_on_save() is deprecated

Any help appreciated, TIA!

[MichaelRLevy]

After some testing and writing out some logs, I can see that the line that triggers the warning is below, and the $string passed here is actually not a string but an array of strings containing the values of the multiselect. So whatever is calling the quote() function in include/database/MysqliManager.php is not passing a string, but is passing an array. Can anyone help?


/**
* @see DBManager::quote()
*/
public function quote($string)
{
return mysqli_real_escape_string($this->getDatabase(),$this->quoteInternal($string));
}

[ahatherly]

I managed to fix this issue by updating the quote method in the MysqliManager.php file as follows:

	/**
	 * @see DBManager::quote()
	 */
	public function quote($string)
	{
		if(is_array($string)) {
              foreach($string as &$val) {
			$val = $this->quoteInternal($val);
		  }
		  return $string;
            }
		return mysqli_real_escape_string($this->getDatabase(),$this->quoteInternal($string));
	}

Hope that helps!
Adam.