Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!news.musoftware.de!wum.musoftware.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: PHP mysql_excape but need to search for those items Date: Mon, 11 Jun 2012 20:38:55 +0200 Lines: 34 Message-ID: References: <3c8fad99-d356-4d8c-acfb-a1fe06503254@v9g2000vbc.googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net r/uKP8l6VoPPAK+J9UuD6AuUjcAqNWBSm+FuRPbDHLj/4sJ30jMUAKfNJi9Jcuk3Nd Cancel-Lock: sha1:USgjzvpz/DqvM9cmIcuP3Y8QETA= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20120518 Firefox/12.0 SeaMonkey/2.9.1 In-Reply-To: Xref: csiph.com comp.lang.php:6286 Jerry Stuckle wrote: > On 6/11/2012 1:01 PM, mrgushi wrote: >> Jerry, >> This is what I'm working with so far. >> >> not sure if I've escaped everything I needed too. >> >> $ENG = mysql_real_escape_string($ENG); >> $result = mysql_query("SELECT * FROM br_test WHERE ENG LIKE '$ENG' "); >> $row = mysql_fetch_array( $result ); >> >> The $ENG is the input from the search form.. >> The JS problem is valid but then again it will be in a locked down iOS >> app using PhoneGAp. An I'll be using a HTTPs tunnel to the PHP >> scripts.. use some sort of cookie with a SSL flag to lock it down. So >> someone could JailBreak an iOS app and dig down in my settings and >> figure out the JS but I don't think that likely but ur right I want to >> take every precaution. >> > Yes, that will work very nicely (although it's not considered good form to use > SELECT * - rather select the individual columns. It will save you heartache > later). > > There are more ways than just jailbreaking the IPhone. There is no guarantee > that the request even came from your app on an IPhone. The request can easily > be faked in any number of ways. And there's no guaranteed way to "lock it > down" and be sure, unless you don't make it ever available via the internet. > Don't forget man in the middle, using https will not protect against that. -- //Aho