Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10418

Re: PS Re: GUI designer in html

Show all headers | View raw

On 05/08/13 23:55, Norman Peelman wrote:
> On 08/05/2013 10:57 AM, Twayne wrote:
>> On 2013-08-05 12:41 AM, J.O. Aho wrote:
>>> On 05/08/13 02:59, Norman Peelman wrote:
>>>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>>
>>
>> ....
>>
>>>>
>>>>    That's only if you go out of your way to enable multiple statements
>>>> by using 'mysqli_multi_query()', which doesn't support prepared
>>>> statements. By default mysqli_query() and mysqli_real_query() do not
>>>> allow multiple queries separated by semi-colons.
>>>>
>>>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>>
>>> Unless something changed, mysqli_query supports multiple statements, 
>>> but
>>> the return value do not support to give you the result from all the
>>> queries, I think it returned the last one.
>>>
>>
>> Quite correct and as the manual states;
>
> No.
>
>> "
>> MySQL optionally allows having multiple statements in one statement
>> string. Sending multiple statements at once reduces client-server round
>> trips but requires special handling.
>>
>> Multiple statements or multi queries must be executed with
>> mysqli_multi_query(). The individual statements of the statement string
>> are separated by semicolon. Then, all result sets returned by the
>> executed statements must be fetched.
>>
>> The MySQL server allows having statements that do return result sets and
>> statements that do not return result sets in one multiple statement.
>> "
>>
>
>   You need to scroll down to the middle of the page and read
> *Security considerations* and *Example #2*.
>
>
Furthermore the manual for mysql_query (as opposed to mysqli_query) 
actually states:

"*mysql_query()* sends a unique query *(multiple queries are not 
supported)* to the currently active database on the server that's 
associated with the specified /|link_identifier|/. "

so it would seem that this actual sql injection method is an urban myth.

 From PHP anyway.

ISTR I actually tried it once to see if my code was robust. I failed to 
destroy the database or indeed any data,  at all.

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GUI designer in html Lightee <lightaiyee@gmail.com> - 2013-08-03 23:32 -0700
  Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 09:17 +0200
  Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 09:23 +0100
    Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 13:10 +0100
    Re: GUI designer in html bill <william@TechServSys.com> - 2013-08-06 09:33 -0400
      Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-06 15:56 +0100
  Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 09:48 -0400
    Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:22 -0400
      Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 17:33 +0100
      Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 22:11 -0400
  Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:40 -0400
    Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 08:14 -0400
  PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:47 -0400
    Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 19:09 +0200
      Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 17:01 -0400
      Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 22:23 +0100
      Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-04 20:59 -0400
        Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-05 06:41 +0200
          Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:57 -0400
            Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 18:55 -0400
              Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-06 00:32 +0100
                Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 19:59 -0400
                Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:51 -0400
                Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-07 18:52 +0100
        Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:51 -0400
          Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 20:00 -0400
          Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 21:35 -0400
            Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:55 -0400

csiph-web