Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6280 > unrolled thread

PHP mysql_excape but need to search for those items

Back to article view | Back to comp.lang.php

Contents

  PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 08:34 -0700
    Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-11 17:54 +0200
      Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 09:48 -0700
        Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:26 +0200
    Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 12:38 -0400
      Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 10:01 -0700
        Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 13:54 -0400
          Re: PHP mysql_excape but need to search for those items "J.O. Aho" <user@example.net> - 2012-06-11 20:38 +0200
            Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 17:06 -0400
              Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:35 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-12 08:00 -0400
                  Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-14 08:47 +0200
                    Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:40 -0400
                      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:36 +0200
                        Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 21:07 -0400
                          Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-16 08:33 +0200
                            Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-16 09:25 -0400
                              Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 09:39 +0200
                                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 08:48 -0400
                                  Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:30 +0200
                                    Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 13:41 -0400
                                      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:49 +0200
                                        Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:10 -0400
                                      Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 20:21 +0200
                                        Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:11 -0400
                                          Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 21:34 +0200
                                            Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 17:22 -0400
                                            Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 15:36 +0200
                                              Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 10:41 -0400
                                                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 17:34 +0200
                                                  Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 12:35 -0400
                                                    Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 18:39 +0200
        Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:32 +0200
    Re: PHP mysql_excape but need to search for those items "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-12 09:38 +0200

Page 2 of 2 — ← Prev page 1 [2]

#6367

On 6/18/2012 1:30 PM, Arno Welzel wrote:
> Jerry Stuckle, 18.06.2012 14:48:
>
> [...]
>> No, you're just full of hot air.
>
> JFTR:
>
> | I'm sorry to have to inform you that your message could not
> | be delivered to one or more recipients. It's attached below.
> |
> | For further assistance, please send mail to postmaster.
> |
> | If you do so, please include this problem report. You can
> | delete your own text from the attached returned message.
> |
> |                    The mail system
> |
> |<jstucklex@attglobal.net>: host mx1.prserv.net[12.154.55.40] said: 551
> not our
> |     customer (in reply to RCPT TO command)
>
> At least you should use the TLD .invalid if you don't want e-mail.
>
> And you offer service for customers? Oh my... m(
>
>

Once again you can't answer the questions because you have none.  So you 
have to make ad hominem attacks.

How like a troll.

Oh, and you need to learn to read.  The instructions for emailing me are 
in my sig in every post.   But I guess that's too hard for you, too.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#6369

Jerry Stuckle, 18.06.2012 19:41:

> Oh, and you need to learn to read.  The instructions for emailing me are
> in my sig in every post.   But I guess that's too hard for you, too.

"Instructions for emailing me are in my sig..."... oh my... m(

If you want people to be able to contact you via email, provide a valid
address.

Instructions in a signture are just a sign that you are not able to run
a proper spam filter on your own and you decided other people should do
the work for you...


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#6372

On 6/18/2012 1:49 PM, Arno Welzel wrote:
> Jerry Stuckle, 18.06.2012 19:41:
>
>> Oh, and you need to learn to read.  The instructions for emailing me are
>> in my sig in every post.   But I guess that's too hard for you, too.
>
> "Instructions for emailing me are in my sig..."... oh my... m(
>
> If you want people to be able to contact you via email, provide a valid
> address.
>
> Instructions in a signture are just a sign that you are not able to run
> a proper spam filter on your own and you decided other people should do
> the work for you...
>
>

If you can't read, then I really don't want you to contact me anyway.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#6371

.oO(Jerry Stuckle)

>Oh, and you need to learn to read.  The instructions for emailing me are 
>in my sig in every post.   But I guess that's too hard for you, too.

"To the postman:
The instructions for mailing me are on the back of the envelope.
Please fix the address as described there to find the right mailbox."

Don't expect people to solve stupid puzzles just in order to contact
you. Either the address works as-is or it doesn't. Maybe you want to
learn how to use spam filters. Or is it too hard for you, so that you
have to let other people do _your_ work?

Micha

-- 
http://mfesser.de/
Fotos | Blog | Flohmarkt

[toc] | [prev] | [next] | [standalone]

#6373

On 6/18/2012 2:21 PM, Michael Fesser wrote:
> .oO(Jerry Stuckle)
>
>> Oh, and you need to learn to read.  The instructions for emailing me are
>> in my sig in every post.   But I guess that's too hard for you, too.
>
> "To the postman:
> The instructions for mailing me are on the back of the envelope.
> Please fix the address as described there to find the right mailbox."
>
> Don't expect people to solve stupid puzzles just in order to contact
> you. Either the address works as-is or it doesn't. Maybe you want to
> learn how to use spam filters. Or is it too hard for you, so that you
> have to let other people do _your_ work?
>
> Micha
>

It's only a puzzle to the stoopid.  The instructions are very clear. 
And using a munged email address on usenet is quite common for very good 
reasons.

If you can't understand the simple instructions, then I don't care that 
you can't contact me.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#6375

.oO(Jerry Stuckle)

>It's only a puzzle to the stoopid.  The instructions are very clear.

Sure, but why should anyone do it? It's completely unnecessary work and
a sign that you care more about yourself than about others.

>And using a munged email address on usenet is quite common for very good 
>reasons.

It's common, but not for good reasons.

Although I use my current mail address for many years in Usenet now and
even use it for various website subscriptions, my inbox is still almost
spam-free because of good and learning filters.

Micha

-- 
http://mfesser.de/
Fotos | Blog | Flohmarkt

[toc] | [prev] | [next] | [standalone]

#6376

On 6/18/2012 3:34 PM, Michael Fesser wrote:
> .oO(Jerry Stuckle)
>
>> It's only a puzzle to the stoopid.  The instructions are very clear.
>
> Sure, but why should anyone do it? It's completely unnecessary work and
> a sign that you care more about yourself than about others.
>

Nope, it means I don't want to put up with spam from automated harvesters.

>> And using a munged email address on usenet is quite common for very good
>> reasons.
>
> It's common, but not for good reasons.
>

That's YOUR opinion.  Hundreds of thousands of USENET users disagree 
with you.

> Although I use my current mail address for many years in Usenet now and
> even use it for various website subscriptions, my inbox is still almost
> spam-free because of good and learning filters.
>
> Micha
>

That's fine.  You have control of your filters.  I do not on this email 
address.  But it's also not one I use for business.  Only USENET.  I 
don't want to have to put up with crap on my business emails.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#6386

Am 18.06.2012 21:34, schrieb Michael Fesser:
> .oO(Jerry Stuckle)
>
>> It's only a puzzle to the stoopid.  The instructions are very clear.
>
> Sure, but why should anyone do it? It's completely unnecessary work and
> a sign that you care more about yourself than about others.
>
>> And using a munged email address on usenet is quite common for very good
>> reasons.
>
> It's common, but not for good reasons.

Is it?

Valid addresses used in the last couple of days in this group:

jwcarlton@gmail.com
hissoka05@gmail.com
taltene@gmail.com
alur.pradeep@gmail.com
apavluck@gmail.com
ircadhikari@gmail.com
erwinmollerusenet@xs4all.nl
kurtk@pobox.com
usenet@arnowelzel.de
netizen@gmx.de
sheldonlg@thevillages.net
php@PointedEars.de
william@TechServSys.com

Valid adresses, but i assume nobody will read e-mail sent there:

nobody@spamcop.net
noonehome@chalupasworld.com
me@privacy.net
Alan_Smith.5cjybz@no-mx.httppoint.com
hellsop@ninehells.com
QUITAESTO@QUITAESTO.NOES

Invalid adresses using TLD ".invalid":

alvaro.NOSPAMTHANX@demogracia.com.invalid
tnp@invalid.invalid

Others - either invalid or "munged" (and also invalid):

sorry_no_mail_here@nowhere.dee
jstucklex@attglobal.net

At least here i can not confirm that it is "common" to munge the sender 
address. Sometimes people use the TLD ".invalid" to indicate that they 
don't want e-mail or they use valid honeypots. The same seems to be true 
for many other newsgroups.

> Although I use my current mail address for many years in Usenet now and
> even use it for various website subscriptions, my inbox is still almost
> spam-free because of good and learning filters.

Same here. My usenet address is the one with *least* spam at all - but 
not only because of good filters, but because only a couple of spammers 
per week try to send something - something changed anyway:

<https://arnowelzel.de/munin/arnowelzel.de/root.arnowelzel.de/postgrey_new-year.png>



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#6387

On 6/19/2012 9:36 AM, Arno Welzel wrote:
> Am 18.06.2012 21:34, schrieb Michael Fesser:
>> .oO(Jerry Stuckle)
>>
>>> It's only a puzzle to the stoopid. The instructions are very clear.
>>
>> Sure, but why should anyone do it? It's completely unnecessary work and
>> a sign that you care more about yourself than about others.
>>
>>> And using a munged email address on usenet is quite common for very good
>>> reasons.
>>
>> It's common, but not for good reasons.
>
> Is it?
>
> Valid addresses used in the last couple of days in this group:
>
> jwcarlton@gmail.com
> hissoka05@gmail.com
> taltene@gmail.com
> alur.pradeep@gmail.com
> apavluck@gmail.com
> ircadhikari@gmail.com
> erwinmollerusenet@xs4all.nl
> kurtk@pobox.com
> usenet@arnowelzel.de
> netizen@gmx.de
> sheldonlg@thevillages.net
> php@PointedEars.de
> william@TechServSys.com
>
> Valid adresses, but i assume nobody will read e-mail sent there:
>
> nobody@spamcop.net
> noonehome@chalupasworld.com
> me@privacy.net
> Alan_Smith.5cjybz@no-mx.httppoint.com
> hellsop@ninehells.com
> QUITAESTO@QUITAESTO.NOES
>

Guess they don't want anyone contacting them offline.

> Invalid adresses using TLD ".invalid":
>
> alvaro.NOSPAMTHANX@demogracia.com.invalid
> tnp@invalid.invalid
>

Guess these guys don't want people contacting them offline, either.

> Others - either invalid or "munged" (and also invalid):
>
> sorry_no_mail_here@nowhere.dee
> jstucklex@attglobal.net
>

Yup, munged.  That way people can get ahold of me if they want.

> At least here i can not confirm that it is "common" to munge the sender
> address. Sometimes people use the TLD ".invalid" to indicate that they
> don't want e-mail or they use valid honeypots. The same seems to be true
> for many other newsgroups.
>

So?  You're looking at one newsgroup - out of tens of thousands.  Hardly 
a representative sampling.

>> Although I use my current mail address for many years in Usenet now and
>> even use it for various website subscriptions, my inbox is still almost
>> spam-free because of good and learning filters.
>
> Same here. My usenet address is the one with *least* spam at all - but
> not only because of good filters, but because only a couple of spammers
> per week try to send something - something changed anyway:
>
> <https://arnowelzel.de/munin/arnowelzel.de/root.arnowelzel.de/postgrey_new-year.png>
>
>

Thanks, but I don't want false positives kicking out valid customers.

And I really don't care that you care so little about your potential 
clients that you would kick out email from them due to a false positive.

So why don't you take your little trollish tirade and stuff it where the 
sun doesn't shine - that way it will be right next to your head.  'Cause 
I really don't give a damn what you think!


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#6391

Am 19.06.2012 16:41, schrieb Jerry Stuckle:

> On 6/19/2012 9:36 AM, Arno Welzel wrote:
[...]
>> Same here. My usenet address is the one with *least* spam at all - but
>> not only because of good filters, but because only a couple of spammers
>> per week try to send something - something changed anyway:
>>
>> <https://arnowelzel.de/munin/arnowelzel.de/root.arnowelzel.de/postgrey_new-year.png>
>
> Thanks, but I don't want false positives kicking out valid customers.

You don't know anything about greylisting? Do you?

> And I really don't care that you care so little about your potential
> clients that you would kick out email from them due to a false positive.

But at least you care enough to tell me that i may not get emails from 
potential clients because of false positives... don't worry, i never 
lost an email due to filtering in the last 10 years (and i don't have to 
spend a lot of time to deal with spam either). Otherwise i wouldn't have 
used this system so far.

> So why don't you take your little trollish tirade and stuff it where the
> sun doesn't shine - that way it will be right next to your head. 'Cause
> I really don't give a damn what you think!

If this was true, you would just have ignored the posting. Anyway - F'up 
to poster... enough here. Sorry for the fuzz.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#6392

On 6/19/2012 11:34 AM, Arno Welzel wrote:
> Am 19.06.2012 16:41, schrieb Jerry Stuckle:
>
>> On 6/19/2012 9:36 AM, Arno Welzel wrote:
> [...]
>>> Same here. My usenet address is the one with *least* spam at all - but
>>> not only because of good filters, but because only a couple of spammers
>>> per week try to send something - something changed anyway:
>>>
>>> <https://arnowelzel.de/munin/arnowelzel.de/root.arnowelzel.de/postgrey_new-year.png>
>>>
>>
>> Thanks, but I don't want false positives kicking out valid customers.
>
> You don't know anything about greylisting? Do you?
>

Yes, I know all about greylisting.

>> And I really don't care that you care so little about your potential
>> clients that you would kick out email from them due to a false positive.
>
> But at least you care enough to tell me that i may not get emails from
> potential clients because of false positives... don't worry, i never
> lost an email due to filtering in the last 10 years (and i don't have to
> spend a lot of time to deal with spam either). Otherwise i wouldn't have
> used this system so far.
>

How do you know?  Potential clients won't tell you.  They'll just go 
somewhere else.

>> So why don't you take your little trollish tirade and stuff it where the
>> sun doesn't shine - that way it will be right next to your head. 'Cause
>> I really don't give a damn what you think!
>
> If this was true, you would just have ignored the posting. Anyway - F'up
> to poster... enough here. Sorry for the fuzz.
>
>
>

You don't even know how to fup a message correctly!  ROFLMAO!


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#6393

Jerry Stuckle, 19.06.2012 18:35:

> You don't even know how to fup a message correctly!  ROFLMAO!

You *knew* that i did want to set a f'up and still continue to post
off-topic here. Of course you never did a mistake in your whole life i
guess.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#6302

mrgushi, 11.06.2012 19:01:

> Jerry,
> This is what I'm working with so far.
> 
> not sure if I've escaped everything I needed too.
> 
> $ENG = mysql_real_escape_string($ENG);
> $result = mysql_query("SELECT * FROM br_test WHERE ENG LIKE '$ENG' ");
> $row = mysql_fetch_array( $result );
> 
> The $ENG is the input from the search form..
> The JS problem is valid but then again it will be in a locked down iOS
> app using PhoneGAp. An I'll be using a HTTPs tunnel to the PHP
> scripts.. use some sort of cookie with a SSL flag to lock it down. So

And this will prevent HTTP requests via SSL by an attacker from
somewhere? Why? Will the queries only be executed, if there is a "valid"
cookie? And why is the cookie "valid"? An attacker can not establish an
SSL connectio to your server? An attacker can not generate "valid"
cookies on his own and use them with curl/wget etc.?

Just to think about...


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#6300

El 11/06/2012 17:34, mrgushi escribió/wrote:
> First time poster here. I'm working on an App that needs to be able to
> querry my DB via PHP in particular those items such as periods commas
> slashes and things that mysql_real_escape_string cleans out to prevent
> SQL injection attacks. How would you recommend doing that securely? My
> SQL login rights in the script are read only is that enough?
>
> I was thinking of using JS to modify the querry before they hit the
> mysql_real_escape_string such that I have a custom DB lookup for each
> major punctuation... A period = punc1 A comma = punc2 etc.... Any
> Alternate thoughts would be appreciated.
> THX
>
> PS- My app is a English Translation guide to Braille so I need to be
> able to lookup punctuation in the DB somehow.

You seem to think that mysql_real_escape_string() strips out certain 
characters. Nope, it doesn't. A database library that corrupts data by 
design would be pretty unreliable!

Just run this query in your favourite MySQL client (get one if you don't 
have any):

SELECT 'O\'Brian'

Does it print a backslash? Sure it doesn't. The backslash is just a SQL 
syntax element, just like the single quotes (which aren't printed either).

Whatever, if I was to write an app from scratch I wouldn't stick to the 
legacy MySQL extension. Needing to escape all parameters one by one is 
pretty annoying. Try out a library that offers prepared statements, such 
as MySQLi or PDO.


-- 
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://borrame.com
-- Mi web de humor satinado: http://www.demogracia.com
--

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.php

csiph-web