Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!rt.uk.eu.org!newsfeed.xs4all.nl!newsfeed2.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Date: Sun, 28 Jul 2013 17:25:57 +0200
From: Luuk <luuk@invalid.lan>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130620 Thunderbird/17.0.7
MIME-Version: 1.0
Newsgroups: comp.lang.php,comp.datbase.mysql
Subject: Re: is mysqli_real_escape_string bullet proof with binary data?
References: <kt040r$i1t$1@news.albasani.net> <bfhcca-8vi.ln1@luuk.invalid.lan> <kt09nh$tjg$1@news.albasani.net> <7gucca-oqm.ln1@luuk.invalid.lan> <kt0lsv$noh$3@news.albasani.net> <775dca-t9p.ln1@luuk.invalid.lan> <kt1lk6$s80$1@dont-email.me> <isgfca-6kg.ln1@luuk.invalid.lan> <kt36ib$4g8$2@dont-email.me>
In-Reply-To: <kt36ib$4g8$2@dont-email.me>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Message-ID: <1ppfca-lqi.ln1@luuk.invalid.lan>
Lines: 55
NNTP-Posting-Host: 2001:980:9089:1:8454:be87:7d27:4050
X-Trace: 1375025401 news.xs4all.nl 15977 [2001:980:9089:1:8454:be87:7d27:4050]:42077
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.php:10277

On 28-07-2013 15:39, Jerry Stuckle wrote:
> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>> three?
>>>>>
>>>>
>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>> Binary file upArrow.png matches
>>>>
>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>> |S....`.cb..P-.`'|
>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>> |..j>.{.-.]c..K'.|
>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>> |Q.'"..K.&.....b2|
>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>> |7$..C2'...I..T..|
>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>> |...A.J'\'Gg.....|
>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>> |..P~....a.a..~.'|
>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>> |..5y$.3.,...'...|
>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>> |...zo.......~r'.|
>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>> |....w'...O._.@.A|
>>>>
>>>>
>
> It doesn't make any difference.  The png could contain one or more
> delimiters, i.e. an apostrophe, which will cause a syntax error in a
> non-prepared statement.

It DOES contain single-quotes (that is an apostophe?).
and that DOES NOT cause a syntax error,
because i'm using a prepared statement.

>
> Escaping strings is not just to prevent security leeks - it is also to
> ensure valid SQL.
>

I dont see any errors in the query.log or error.log of my MySQL 
installation (about updating this `testpng`-table).
Therefore i dont see a point in ensuring validity of an already valid SQL.

Can you give an example an file that would break my script?
The script is here: http://pastebin.com/5D8ZGEhy
My emailadress is: luuk34@gmail.com

I think i have shown that this script is working OK, and that there is 
no reason to do something with escaping string here.