CiviCRM Community Forums (archive)

I hit a core error importing notes where there was an apostrophe in the data I was trying to import (from another DB).

Does responsibility for handling the appostrophes rest with the Civi api or the function calling it?

escaping the ' and writing it to the DB in a valid manner (and prevent SQL injection attacks) should be the responsibility to the function that writes the data to the DB. The higher level functions (including the API) should not do any escaping (else we might escape things multiple times) unless they are doing a write call to the DB (in which case proper use of executeQuery does the escaping for u!)

lobo

Index: api/v3/utils.php
===================================================================
--- api/v3/utils.php   (revision 32992)
OK - mandatory check was allowing empty fields  to be mandatory - this fixes it for entity id & my test passes

+++ api/v3/utils.php   (working copy)
@@ -871,7 +871,7 @@
         }
 
         if ( isset( $v['required'] ) ) {
-            if ($v['required'] && !(isset($params[$k]))) {
+            if ($v['required'] && (empty($params[$k]))) {
                 $missing[] = $k;
             }
         }