Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #10301
| From | Jerry Stuckle <jstucklex@attglobal.net> |
|---|---|
| Newsgroups | comp.lang.php, comp.database.mysql |
| Subject | Re: is mysqli_real_escape_string bullet proof with binary data? |
| Date | 2013-07-29 21:02 -0400 |
| Organization | A noiseless patient Spider |
| Message-ID | <kt72vo$vmi$1@dont-email.me> (permalink) |
| References | (10 earlier) <kt3pl9$gap$2@dont-email.me> <097gca-1mo.ln1@luuk.invalid.lan> <kt4dle$me9$1@dont-email.me> <7AwJt.296856$aW2.295134@fx13.iad> <kt6sde$obj$1@news.albasani.net> |
Cross-posted to 2 groups.
On 7/29/2013 7:04 PM, The Natural Philosopher wrote:
> Further to this thread I THINK I have established a third way to get
> clean binary data into a blob.
> I looked at what phpmyadmin was doing and developed this code.
> ( it's just the relevant fragment. Its a screen to upload a single file
> and some other form stuff and update the SQL record. )
> ====================
> if($_FILES['uploaded_file']['error']!="")
> {
> $havefile=FALSE;
> }
> else
> {
> $code=file_get_contents($_FILES['uploaded_file']['tmp_name']);
> $size=$_FILES['uploaded_file']['size'];
> $filename=$_FILES['uploaded_file']['name'];
> $havefile=TRUE;
> }
> if (($id=get_id())>0) // its an update
> {
> if($havefile)
> $query=sprintf("update adminmodule set uri='%s',
> descr='%s', privilege_level='%d', filename='%s', size='%d', code=0x%s,
> modified_by='%d', modified_on=now() where id='%d'",
> $_POST['uri'],$_POST['descr'],$_POST['privilege_level'],$filename,
> $size, bin2hex($code), $login_id,$id);
> else
> $query=sprintf("update adminmodule set uri='%s',
> descr='%s', privilege_level='%d', modified_by='%d', modified_on=now()
> where id='%d'",
> $_POST['uri'],$_POST['descr'],$_POST['privilege_level'],$login_id,$id);
> mysqli_query($link,$query);
> }
> =======================
> That is, if you have a variable with binary data in it, run bin2hex()
> on it and prepend '0x' to it and throw it at a simple sql update or
> insert statement.
>
> I didnt know MySQL accepted hex data in that form.
>
> Not as efficient as a prepared statement for big objects, but its
> simple to understand. And it avoids load_file.
>
> In this case its optimal. The code is simple, no FILE privileges are
> required. Since inserts and updates are rare things done by a few people
> the inefficiency won't load up the server hugely.
>
A beautiful way to ensure your database gets hacked (not cleaning the
$_POST data before trying to insert into the database).
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 10:31 +0100
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 11:45 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 12:08 +0100
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:28 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:36 +0100
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:22 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:34 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 19:44 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 14:54 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-28 15:35 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 09:39 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 17:25 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 15:05 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 21:16 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 20:46 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-07-29 09:17 -0700
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 14:01 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-30 00:04 +0100
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 21:02 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:34 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:52 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:58 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:36 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:43 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 09:35 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:56 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 20:01 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:33 +0100
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:57 -0400
I've always used GD, but never been 100% happy with it (Was: is mysqli_real_escape_string bullet proof with binary data?) "J.O. Aho" <user@example.net> - 2013-07-27 18:09 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:37 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 07:31 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 02:08 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? Scott Johnson <noonehome@chalupasworld.com> - 2013-07-30 05:35 -0700
Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 17:53 +0200
Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 12:37 -0400
Re: is mysqli_real_escape_string bullet proof with binary data? tony@mountifield.org (Tony Mountifield) - 2013-07-30 09:35 +0000
Re: is mysqli_real_escape_string bullet proof with binary data? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-31 04:56 +0000
csiph-web