Path: csiph.com!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: PHP mysql_excape but need to search for those items Date: Tue, 12 Jun 2012 11:32:06 +0200 Organization: A noiseless patient Spider Lines: 29 Message-ID: <4FD70C96.90505@arnowelzel.de> References: <3c8fad99-d356-4d8c-acfb-a1fe06503254@v9g2000vbc.googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="l9c/A+zTZgD4vXu1XJ7hjg"; logging-data="30817"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/4N1hXuhrqL2n/bGRsDIZpDB8aCh9JIbA=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 In-Reply-To: Cancel-Lock: sha1:ub3ZIWYz+L1rUBkD7YxlvUkaXA8= Xref: csiph.com comp.lang.php:6302 mrgushi, 11.06.2012 19:01: > Jerry, > This is what I'm working with so far. > > not sure if I've escaped everything I needed too. > > $ENG = mysql_real_escape_string($ENG); > $result = mysql_query("SELECT * FROM br_test WHERE ENG LIKE '$ENG' "); > $row = mysql_fetch_array( $result ); > > The $ENG is the input from the search form.. > The JS problem is valid but then again it will be in a locked down iOS > app using PhoneGAp. An I'll be using a HTTPs tunnel to the PHP > scripts.. use some sort of cookie with a SSL flag to lock it down. So And this will prevent HTTP requests via SSL by an attacker from somewhere? Why? Will the queries only be executed, if there is a "valid" cookie? And why is the cookie "valid"? An attacker can not establish an SSL connectio to your server? An attacker can not generate "valid" cookies on his own and use them with curl/wget etc.? Just to think about... -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de