Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10250

Re: is mysqli_real_escape_string bullet proof with binary data?

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Denis McMahon <denismfmcmahon@gmail.com> writes:

> On Sat, 27 Jul 2013 11:45:50 +0200, Luuk wrote:
>
>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>
>>> The target is to create and store thumbnail PNG images in a Mysql
>>> table.
>
>> As far as the subject goes, i would say:
>> DO NOT TOUCH binary data.....
>> Simply store it, or not, in your database.....
>
> Is it trying to store binary data as character data, or does it think it 
> needs to string escape binary data types?

Escaping strings is a concept only useful when building request strings
that include user supplied data. It does avoid concatenating strings
whith special/control characters that may interfere with the original
language. There is no need to escape strings if you do not embed
them inside your request string (eg. if you use bound parameters).

This is true when dealing with SQL (write prepared statements without
including any user supplied data, then bind the parameters), bash
commands that only require one exec (use exec* instead of system), and
pretty much in any case you construct interpreted code at runtime.

Data sent to MySQL as bound parameters in prepared statements is
shipped as is, it not escaped or processed in any way before the
MySQL API structures are filled with it. Now, for your binary data
to be handled as is by the MySQL server (and skip the charset
processing), the parameter must be bound as MYSQL_TYPE_BLOB, which
you may control when using bind_param.

See http://fr2.php.net/manual/fr/mysqli-stmt.bind-param.php and the
"b" (as in binary) flag for details.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: is mysqli_real_escape_string bullet proof with binary data? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-27 18:38 +0000
  Re: is mysqli_real_escape_string bullet proof with binary data? Pierre Jaury <pierre@jaury.eu> - 2013-07-27 22:25 +0200
    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 22:59 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-28 00:50 +0100
        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 17:44 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? Pierre Jaury <pierre@jaury.eu> - 2013-07-28 18:01 +0200
            Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-28 17:43 +0100
            Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 20:31 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-28 17:39 +0100
            Re: is mysqli_real_escape_string bullet proof with binary data? Pierre Jaury <pierre@jaury.eu> - 2013-07-28 19:56 +0200
              Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-28 19:14 +0100
                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 15:10 -0400
            Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-28 21:13 -0400
    Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-28 00:46 +0100
    Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 19:56 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? Pierre Jaury <pierre@jaury.eu> - 2013-07-28 03:55 +0200
        Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 22:11 -0400
  Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 19:58 -0400

csiph-web