Re: is mysqli_real_escape_string bullet proof with binary data?

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!us.feeder.erje.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	"J.O. Aho" <user@example.net>
Newsgroups	comp.lang.php, comp.datbase.mysql
Subject	Re: is mysqli_real_escape_string bullet proof with binary data?
Date	Sun, 28 Jul 2013 15:35:08 +0200
Lines	20
Message-ID	<b5kl0cFss7gU1@mid.individual.net> (permalink)
References	<kt040r$i1t$1@news.albasani.net> <bfhcca-8vi.ln1@luuk.invalid.lan> <kt09nh$tjg$1@news.albasani.net> <7gucca-oqm.ln1@luuk.invalid.lan> <kt0lsv$noh$3@news.albasani.net> <775dca-t9p.ln1@luuk.invalid.lan> <kt1lk6$s80$1@dont-email.me> <isgfca-6kg.ln1@luuk.invalid.lan>
Mime-Version	1.0
Content-Type	text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding	7bit
X-Trace	individual.net w5gKKKx2RwJHnQksJhkxnQtIFntOnCYzV8t9HJEyP+4tnNiyL7
Cancel-Lock	sha1:0jhU1+y91Y5PPzj8VZIQfECZ1tA=
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130628 Thunderbird/17.0.7
In-Reply-To	<isgfca-6kg.ln1@luuk.invalid.lan>
Xref	csiph.com comp.lang.php:10272

Cross-posted to 2 groups.

Show key headers only | View raw

On 28/07/13 14:54, Luuk wrote:

> I think i was using a prepared statement.
> And i wonder why i need to check if the contents of this png-file is
> really a png-file, or maybe a script. I'm not executing any code that
> MIGHT be stored in this file. I'm just storing the contents of that file
> in some blob.

If you worry that the image data includes something that may cause the 
database do something else than just insert the image, then see to 
base64 encode it first, this way you will not be affected by the 
content, of course you make things a bit more "heavy" for the system as 
you will need to decode the blob each time you want to use the image, 
but then if you use some sort of cache then you can store the decoded 
blob in the cache and use it as long as it residence there.

-- 

  //Aho

Thread

is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 10:31 +0100
  Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 11:45 +0200
    Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 12:08 +0100
      Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:28 +0200
        Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:36 +0100
          Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:22 +0200
            Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:34 +0200
            Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 19:44 -0400
              Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 14:54 +0200
                Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-28 15:35 +0200
                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 09:39 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 17:25 +0200
                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 15:05 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 21:16 +0200
                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 20:46 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-07-29 09:17 -0700
                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 14:01 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-30 00:04 +0100
                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 21:02 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:34 +0200
    Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:52 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:58 +0200
        Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:36 -0400
          Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:43 -0400
  Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 09:35 -0400
    Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:56 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 20:01 -0400
    Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:33 +0100
  Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:57 -0400
  I've always used GD, but never been 100% happy with it (Was: is mysqli_real_escape_string bullet proof with binary data?) "J.O. Aho" <user@example.net> - 2013-07-27 18:09 +0200
  Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:37 +0200
    Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 07:31 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 02:08 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? Scott Johnson <noonehome@chalupasworld.com> - 2013-07-30 05:35 -0700
        Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 17:53 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 12:37 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? tony@mountifield.org (Tony Mountifield) - 2013-07-30 09:35 +0000
    Re: is mysqli_real_escape_string bullet proof with binary data? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-31 04:56 +0000

csiph-web