0

We are using Wordpress as an internal Wiki.

We are using SQL Server. I know Wordpress is geared towards MySQL.

An article will not post if there is a backslash in the article. It will just save the article as "auto-draft" but it will then clear your submission page and all your work will be done .

You can use a forward slash, but when a backslash is entered, all is lost.

I know it is not the (Frontier) plugin - it happens on the normal post in admin - which does not use any plugin.

I used SQL Server Profiler. When there is a backslash, the SQL parameters incorrectly get enclosed by a

`

(grave accent / backtick) character. This is what is causing the problem. enter image description here

I’ve also just found this: After the first column that had the forward slash, all columns following thereafter in the SQL statement, erroneously get the backticks

How do I get rid of the backtick?

I have installed updated drivers for PHP_SQL_Server : 4.0.

I updated the drivers in php.ini : extension=php_pdo_sqlsrv.dll extension=php_sqlsrv.dll

and wp-config.php /** Database Type. Defaults to mysql */ define('DB_TYPE', 'pdo_sqlsrv');

But after these updates, the site does not work at all.

WordPress database error 42000 : [Microsoft][ODBC Driver 11 for SQL Server][SQL Server]Incorrect syntax near '`'. for query UPDATE wp_posts SET post_author = yyy, post_date =  N'2017-04-16 16:52:44.000', post_date_gmt =  N'2017-04-16 14:52:44.000', post_content =  N'\\ \', `post_content_filtered` =  N'', `post_title` =  N'test \\', `post_excerpt` =  N'', `post_status` =  N'draft', `post_type` =  N'post', `comment_status` =  N'closed', `ping_status` =  N'open', `post_password` =  N'', WHERE ID = xxx made by edit_post, wp_update_post, wp_insert_post, pdo_wpdb->query, pdo_wpdb->_post_query, pdo_wpdb->print_error
0

I can't simulate this on a clean install of WordPress. So probably there is some extra filtering of XSS/Injection prevention happening on the server side. You should probably check that out first.

enter image description here

5
  • Hi Niels, when I create a post, and the post has a backslash, then the SQL that I am seeing, gets the backtick as indicated (It seems the example you posted has a backtick in the text - not around the SQL) Apr 14 '17 at 9:08
  • @PeterPitLock no difference there on a clean install. Backslashes are working to. So my answer stands, it's something different then WordPress. Probably an pro-active SQL injection filter on the server. Apr 14 '17 at 10:14
  • Which version of SQL Server did you use? Did you use any plugins like frontier? Wondering if this could be frontier Apr 14 '17 at 11:46
  • @PeterPitLock MySQL 5.6 on a clean install (no plugins). I do this to eliminate the possibility that its a WordPress bug. Enable all your plugins to see if it persists. If not, enable them one by one to find the culprit. Apr 14 '17 at 11:48
  • The problem is this is SQL Server and not MySQL. It is definitely a major part of the problem. I did disable all the plugins - except I could not disable Frontier - and it still persisted. Apr 14 '17 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.