View Issue Details

IDProjectCategoryView StatusLast Update
0006570OXID eShop (all versions)4.01. Database handlingpublic2024-04-03 09:16
Reportertjungcl Assigned To 
Status confirmedResolutionopen 
Product Version4.10.2 / 5.3.2 
Summary0006570: oxbase save function can cause sql error
DescriptionThe function oxbase->save() first checks if data exists, then either inserts or updates.

Since those are two seperate operations, they are not atomic. -> The data may not exist when checking but be present when the insert operation runs a moment later.

Steps To ReproduceNot reproducable, but visible in the exception-log.
Additional InformationoxConnectionException-oxException (time: 2017-01-09 10:55:04): [1062]: mysqli error: [1062: Duplicate entry 'xxx' for key 'PRIMARY'] in EXECUTE (Insert into oxuserbaskets set oxid = 'xxx',oxuserid = 'yyy',oxtitle = 'savedbasket',oxpublic = '1',oxupdate = 'zzz', Array) with user xyz

 Stack Trace: #0 /var/www/html/core/adodblite/adodbSQL_drivers/mysqli/ adodb_throw('mysqli', 'EXECUTE', 1062, 'Duplicate entry...', 'Insert into oxu...', Array, Object(object_ADOConnection))
#1 /var/www/html/core/adodblite/ mysqli_driver_ADOConnection->do_query('Insert into oxu...', -1, -1, Array)
#2 /var/www/html/core/oxlegacydb.php(236): ADOConnection->Execute('Insert into oxu...', Array)
#3 /var/www/html/core/oxbase.php(1853): oxLegacyDb->execute('Insert into oxu...')
#4 /var/www/html/application/models/oxuserbasket.php(82): oxBase->_insert()
#5 /var/www/html/core/oxbase.php(1073): oxUserBasket->_insert()
#6 /var/www/html/application/models/oxuserbasket.php(311): oxBase->save()

TagsNo tags attached.
ThemeNot defined
BrowserNot defined
PHP Version5.6
Database VersionNot defined



2017-01-09 13:42

administrator   ~0011909

Regarding the following statement - "The data may not exist when checking but be present when the insert operation runs a moment later."

Can you provide any instance( or scenario ) when data could inserted between the CHECK and INSERT/UPDATE functions.


2017-01-09 14:11

reporter   ~0011910

Last edited: 2017-01-09 14:25

Yes if the shopsystem loads multiple request via ajax, several php instances run with identical session data. In that scenario ( and with a little bad luck) the error occures.

Sven Brunk

2024-04-03 09:16

administrator   ~0016690

This has changed a little, but it is still not safe against dirty reads: