Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!us.feeder.erje.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: "J.O. Aho" <user@example.net>
Newsgroups: comp.lang.php,comp.datbase.mysql
Subject: Re: is mysqli_real_escape_string bullet proof with binary data?
Date: Sun, 28 Jul 2013 15:35:08 +0200
Lines: 20
Message-ID: <b5kl0cFss7gU1@mid.individual.net>
References: <kt040r$i1t$1@news.albasani.net> <bfhcca-8vi.ln1@luuk.invalid.lan> <kt09nh$tjg$1@news.albasani.net> <7gucca-oqm.ln1@luuk.invalid.lan> <kt0lsv$noh$3@news.albasani.net> <775dca-t9p.ln1@luuk.invalid.lan> <kt1lk6$s80$1@dont-email.me> <isgfca-6kg.ln1@luuk.invalid.lan>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Trace: individual.net w5gKKKx2RwJHnQksJhkxnQtIFntOnCYzV8t9HJEyP+4tnNiyL7
Cancel-Lock: sha1:0jhU1+y91Y5PPzj8VZIQfECZ1tA=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130628 Thunderbird/17.0.7
In-Reply-To: <isgfca-6kg.ln1@luuk.invalid.lan>
Xref: csiph.com comp.lang.php:10272

On 28/07/13 14:54, Luuk wrote:

> I think i was using a prepared statement.
> And i wonder why i need to check if the contents of this png-file is
> really a png-file, or maybe a script. I'm not executing any code that
> MIGHT be stored in this file. I'm just storing the contents of that file
> in some blob.

If you worry that the image data includes something that may cause the 
database do something else than just insert the image, then see to 
base64 encode it first, this way you will not be affected by the 
content, of course you make things a bit more "heavy" for the system as 
you will need to decode the blob each time you want to use the image, 
but then if you use some sort of cache then you can store the decoded 
blob in the cache and use it as long as it residence there.


-- 

  //Aho