Re: Help required with UPDATE columns

Path	csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!newsreader4.netcologne.de!news.netcologne.de!newsfeed.arcor.de!newsspool4.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Content-Type	text/plain; charset="UTF-8"
Message-ID	<1378599.qsJR3PFr2n@PointedEars.de> (permalink)
From	Thomas 'PointedEars' Lahn <PointedEars@web.de>
Reply-To	Thomas 'PointedEars' Lahn <php@PointedEars.de>
Organization	PointedEars Software (PES)
Date	Tue, 06 Nov 2012 19:13:05 +0100
User-Agent	KNode/4.4.11
Content-Transfer-Encoding	8Bit
X-Face	%i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px\|[=M@7=Ik[_w<%n1Up"LPQNu2m8\|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face	iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Subject	Re: Help required with UPDATE columns
Newsgroups	comp.lang.php
References	<ff0i989e35u20dfsfalfah7e77o4lbit41@4ax.com> <k7b0nc$vvr$1@dont-email.me> <2525795.FS5DWkFXQh@PointedEars.de> <k7bjj3$sp5$1@dont-email.me>
Followup-To	comp.lang.php
MIME-Version	1.0
Lines	32
NNTP-Posting-Date	06 Nov 2012 19:13:05 CET
NNTP-Posting-Host	c77808f9.newsspool4.arcor-online.net
X-Trace	DXC=eC:ge2_YCmJ@Y=h<_c3PkH4IUK<Cl32<A4Fo<]lROoRA8kF<OcfhCOK0bK78=TXjmNDZm8W4\YJNLJ`:FmdeL>K@IFUG^LZW^_LLjm4]1Y=d6A
X-Complaints-To	usenet-abuse@arcor.de
Xref	csiph.com comp.lang.php:7475

Followups directed to: comp.lang.php

Show key headers only | View raw

Shake wrote:

> El 06/11/2012 18:59, Thomas 'PointedEars' Lahn escribió:
>> Either one allows for SQL injection.  The OP should read on Prepared
>> Statements (but at least mysql_real_escape_string()) instead.
> [...]
>> The parentheses are unnecessary and misleading.  The names should be
>> backtick-quoted.
>>
>>> That's not a PHP problem. Is a SQL one.
>>
>> _MySQL_, and you do not appear to know either very well.
> 
> I just signaled the main error. That's doesn't mean I don't know very
> well. And, the error, isn't _MySQL_ The error is in the SQL sentence.
> And this sentence is wrong in MySQL... and in others SQL-DBs.

You are mistaken.  Whether the query is syntactically wrong in the DBMS 
depends on the data type, the value of the variable (that we do not know, do 
we?) and the query language.

The actual and much more grave issue here is that the OP is using user input 
($_POST['…']) unchecked and unescaped, which allows for SQL injection.  If 
they fixed that with Prepared Statements, both problems would go away.

PointedEars
-- 
    realism:    HTML 4.01 Strict
    evangelism: XHTML 1.0 Strict
    madness:    XHTML 1.1 as application/xhtml+xml
                                                    -- Bjoern Hoehrmann

Thread

Help required with UPDATE columns Dynamo - 2012-11-06 12:40 +0000
  Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 13:44 +0100
    Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 18:59 +0100
      Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:06 +0100
        Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:13 +0100
          Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:20 +0100
            Re: Help required with UPDATE columns "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-11-06 19:30 +0100
              Re: Help required with UPDATE columns Shake <QUITAESTO@QUITAESTO.NOES> - 2012-11-06 19:45 +0100
                Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:57 +0100
                Re: Help required with UPDATE columns "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-11-06 20:36 +0100
            Re: Help required with UPDATE columns Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-11-06 19:53 +0100
              Re: Help required with UPDATE columns Shake <alex.estevezQUENO@QUENOfilnet.es> - 2012-11-06 20:36 +0100
            Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-06 15:02 -0500
    Re: Help required with UPDATE columns Dynamo - 2012-11-07 11:07 +0000
  Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-06 08:15 -0500
    Re: Help required with UPDATE columns Dynamo - 2012-11-07 11:05 +0000
      Re: Help required with UPDATE columns Jerry Stuckle <jstucklex@attglobal.net> - 2012-11-07 07:07 -0500

csiph-web