Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10419

Re: PS Re: GUI designer in html

Show all headers | View raw

On 8/5/2013 7:32 PM, The Natural Philosopher wrote:
> On 05/08/13 23:55, Norman Peelman wrote:
>> On 08/05/2013 10:57 AM, Twayne wrote:
>>> On 2013-08-05 12:41 AM, J.O. Aho wrote:
>>>> On 05/08/13 02:59, Norman Peelman wrote:
>>>>> On 08/04/2013 01:09 PM, J.O. Aho wrote:
>>>>
>>>
>>> ....
>>>
>>>>>
>>>>>    That's only if you go out of your way to enable multiple statements
>>>>> by using 'mysqli_multi_query()', which doesn't support prepared
>>>>> statements. By default mysqli_query() and mysqli_real_query() do not
>>>>> allow multiple queries separated by semi-colons.
>>>>>
>>>>> http://us2.php.net/manual/en/mysqli.quickstart.multiple-statement.php
>>>>
>>>> Unless something changed, mysqli_query supports multiple statements,
>>>> but
>>>> the return value do not support to give you the result from all the
>>>> queries, I think it returned the last one.
>>>>
>>>
>>> Quite correct and as the manual states;
>>
>> No.
>>
>>> "
>>> MySQL optionally allows having multiple statements in one statement
>>> string. Sending multiple statements at once reduces client-server round
>>> trips but requires special handling.
>>>
>>> Multiple statements or multi queries must be executed with
>>> mysqli_multi_query(). The individual statements of the statement string
>>> are separated by semicolon. Then, all result sets returned by the
>>> executed statements must be fetched.
>>>
>>> The MySQL server allows having statements that do return result sets and
>>> statements that do not return result sets in one multiple statement.
>>> "
>>>
>>
>>   You need to scroll down to the middle of the page and read
>> *Security considerations* and *Example #2*.
>>
>>
> Furthermore the manual for mysql_query (as opposed to mysqli_query)
> actually states:
>
> "*mysql_query()* sends a unique query *(multiple queries are not
> supported)* to the currently active database on the server that's
> associated with the specified /|link_identifier|/. "
>
> so it would seem that this actual sql injection method is an urban myth.
>
>  From PHP anyway.
>
> ISTR I actually tried it once to see if my code was robust. I failed to
> destroy the database or indeed any data,  at all.
>

Incorrect (as usual).

It only means you can't run multiple SQL statements.  But that is only 
ONE method of SQL injection; it is quite possible to screw up a database 
in a single SQL statement.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

GUI designer in html Lightee <lightaiyee@gmail.com> - 2013-08-03 23:32 -0700
  Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 09:17 +0200
  Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 09:23 +0100
    Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 13:10 +0100
    Re: GUI designer in html bill <william@TechServSys.com> - 2013-08-06 09:33 -0400
      Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-06 15:56 +0100
  Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 09:48 -0400
    Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:22 -0400
      Re: GUI designer in html Tim Streater <timstreater@greenbee.net> - 2013-08-04 17:33 +0100
      Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-04 22:11 -0400
  Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:40 -0400
    Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 08:14 -0400
  PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 12:47 -0400
    Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-04 19:09 +0200
      Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-04 17:01 -0400
      Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-04 22:23 +0100
      Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-04 20:59 -0400
        Re: PS Re: GUI designer in html "J.O. Aho" <user@example.net> - 2013-08-05 06:41 +0200
          Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:57 -0400
            Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 18:55 -0400
              Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-06 00:32 +0100
                Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 19:59 -0400
                Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:51 -0400
                Re: PS Re: GUI designer in html The Natural Philosopher <tnp@invalid.invalid> - 2013-08-07 18:52 +0100
        Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-05 10:51 -0400
          Re: PS Re: GUI designer in html Jerry Stuckle <jstucklex@attglobal.net> - 2013-08-05 20:00 -0400
          Re: PS Re: GUI designer in html Norman Peelman <npeelman@cfl.rr.com> - 2013-08-05 21:35 -0400
            Re: PS Re: GUI designer in html Twayne <nobody@spamcop.net> - 2013-08-07 12:55 -0400

csiph-web