Groups > comp.lang.php > #10234 > unrolled thread

is mysqli_real_escape_string bullet proof with binary data?

Started by	The Natural Philosopher <tnp@invalid.invalid>
First post	2013-07-27 10:31 +0100
Last post	2013-07-31 04:56 +0000
Articles	20 on this page of 38 — 9 participants

Back to article view | Back to comp.lang.php

  is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 10:31 +0100
    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 11:45 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 12:08 +0100
        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:28 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:36 +0100
            Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:22 +0200
              Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:34 +0200
              Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 19:44 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 14:54 +0200
                  Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-28 15:35 +0200
                  Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 09:39 -0400
                    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 17:25 +0200
                      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 15:05 -0400
                        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 21:16 +0200
                          Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 20:46 -0400
                            Re: is mysqli_real_escape_string bullet proof with binary data? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-07-29 09:17 -0700
                              Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 14:01 -0400
                              Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-30 00:04 +0100
                                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 21:02 -0400
                            Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:34 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:52 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:58 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:36 -0400
            Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:43 -0400
    Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 09:35 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:56 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 20:01 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:33 +0100
    Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:57 -0400
    I've always used GD, but never been 100% happy with it (Was: is mysqli_real_escape_string bullet proof with binary data?) "J.O. Aho" <user@example.net> - 2013-07-27 18:09 +0200
    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:37 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 07:31 +0200
        Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 02:08 -0400
          Re: is mysqli_real_escape_string bullet proof with binary data? Scott Johnson <noonehome@chalupasworld.com> - 2013-07-30 05:35 -0700
          Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 17:53 +0200
            Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 12:37 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? tony@mountifield.org (Tony Mountifield) - 2013-07-30 09:35 +0000
      Re: is mysqli_real_escape_string bullet proof with binary data? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-31 04:56 +0000

Page 1 of 2 [1] 2 Next page →

#10234 — is mysqli_real_escape_string bullet proof with binary data?

From	The Natural Philosopher <tnp@invalid.invalid>
Date	2013-07-27 10:31 +0100
Subject	is mysqli_real_escape_string bullet proof with binary data?
Message-ID	<kt040r$i1t$1@news.albasani.net>

The target is to create and store thumbnail PNG images in a Mysql table.
Also any tips on actually getting the thumbnail data into a variable - 
which package is recommended? I've always used GD, but never been 100% 
happy with it

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [next] | [standalone]

#10235

From	Luuk <luuk@invalid.lan>
Date	2013-07-27 11:45 +0200
Message-ID	<bfhcca-8vi.ln1@luuk.invalid.lan>
In reply to	#10234

On 27-07-2013 11:31, The Natural Philosopher wrote:
> The target is to create and store thumbnail PNG images in a Mysql table.
> Also any tips on actually getting the thumbnail data into a variable -
> which package is recommended? I've always used GD, but never been 100%
> happy with it
>

As far as the subject goes, i would say:
DO NOT TOUCH binary data.....

Simply store it, or not, in your database.....

[toc] | [prev] | [next] | [standalone]

#10236

From	The Natural Philosopher <tnp@invalid.invalid>
Date	2013-07-27 12:08 +0100
Message-ID	<kt09nh$tjg$1@news.albasani.net>
In reply to	#10235

On 27/07/13 10:45, Luuk wrote:
> On 27-07-2013 11:31, The Natural Philosopher wrote:
>> The target is to create and store thumbnail PNG images in a Mysql table.
>> Also any tips on actually getting the thumbnail data into a variable -
>> which package is recommended? I've always used GD, but never been 100%
>> happy with it
>>
>
> As far as the subject goes, i would say:
> DO NOT TOUCH binary data.....
>
> Simply store it, or not, in your database.....
Well exactly. the question is how to get it in there reliably using the 
PHP API.

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10237

From	Luuk <luuk@invalid.lan>
Date	2013-07-27 15:28 +0200
Message-ID	<7gucca-oqm.ln1@luuk.invalid.lan>
In reply to	#10236

On 27-07-2013 13:08, The Natural Philosopher wrote:
> On 27/07/13 10:45, Luuk wrote:
>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>>> The target is to create and store thumbnail PNG images in a Mysql table.
>>> Also any tips on actually getting the thumbnail data into a variable -
>>> which package is recommended? I've always used GD, but never been 100%
>>> happy with it
>>>
>>
>> As far as the subject goes, i would say:
>> DO NOT TOUCH binary data.....
>>
>> Simply store it, or not, in your database.....
> Well exactly. the question is how to get it in there reliably using the
> PHP API.
>
>


When reading file contents, i see no need to do a mysqli_real_escape.

<?php
   $link = mysqli_connect("localhost","test","test","test") or 
die("Error " . mysqli_error($link));

   $query = "CREATE TABLE `testpng` ( `id` int(11) NOT NULL 
AUTO_INCREMENT, `image` blob, PRIMARY KEY (`id`))";
   $result = $link->query($query);

   if (!$result) { echo "Could not create table....\n"; exit; } else {
     $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
     $file = file_get_contents('upArrow.png');
     echo "Size before: ".strlen($file)."<br>\n";
     $stmt->bind_param('s', $file);
     $stmt->execute();
     printf("%d Row inserted.\n", $stmt->affected_rows);
     $stmt->close();

     $stmt = $link->query("SELECT image FROM testpng;");
     $row = $stmt->fetch_object();
     $file = $row->image;
     echo "Size before: ".strlen($file)."<br>\n";
   }
?>

[toc] | [prev] | [next] | [standalone]

#10245

From	The Natural Philosopher <tnp@invalid.invalid>
Date	2013-07-27 15:36 +0100
Message-ID	<kt0lsv$noh$3@news.albasani.net>
In reply to	#10237

On 27/07/13 14:28, Luuk wrote:
> On 27-07-2013 13:08, The Natural Philosopher wrote:
>> On 27/07/13 10:45, Luuk wrote:
>>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>>>> The target is to create and store thumbnail PNG images in a Mysql 
>>>> table.
>>>> Also any tips on actually getting the thumbnail data into a variable -
>>>> which package is recommended? I've always used GD, but never been 100%
>>>> happy with it
>>>>
>>>
>>> As far as the subject goes, i would say:
>>> DO NOT TOUCH binary data.....
>>>
>>> Simply store it, or not, in your database.....
>> Well exactly. the question is how to get it in there reliably using the
>> PHP API.
>>
>>
>
>
> When reading file contents, i see no need to do a mysqli_real_escape.
>
> <?php
>   $link = mysqli_connect("localhost","test","test","test") or 
> die("Error " . mysqli_error($link));
>
>   $query = "CREATE TABLE `testpng` ( `id` int(11) NOT NULL 
> AUTO_INCREMENT, `image` blob, PRIMARY KEY (`id`))";
>   $result = $link->query($query);
>
>   if (!$result) { echo "Could not create table....\n"; exit; } else {
>     $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>     $file = file_get_contents('upArrow.png');
>     echo "Size before: ".strlen($file)."<br>\n";
>     $stmt->bind_param('s', $file);
>     $stmt->execute();
>     printf("%d Row inserted.\n", $stmt->affected_rows);
>     $stmt->close();
>
>     $stmt = $link->query("SELECT image FROM testpng;");
>     $row = $stmt->fetch_object();
>     $file = $row->image;
>     echo "Size before: ".strlen($file)."<br>\n";
>   }
> ?>
..and hope that the file 'upArrow.png' does not contain a ['] or three?

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10247

From	Luuk <luuk@invalid.lan>
Date	2013-07-27 17:22 +0200
Message-ID	<775dca-t9p.ln1@luuk.invalid.lan>
In reply to	#10245

On 27-07-2013 16:36, The Natural Philosopher wrote:
> On 27/07/13 14:28, Luuk wrote:
>> On 27-07-2013 13:08, The Natural Philosopher wrote:
>>> On 27/07/13 10:45, Luuk wrote:
>>>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>>>>> The target is to create and store thumbnail PNG images in a Mysql
>>>>> table.
>>>>> Also any tips on actually getting the thumbnail data into a variable -
>>>>> which package is recommended? I've always used GD, but never been 100%
>>>>> happy with it
>>>>>
>>>>
>>>> As far as the subject goes, i would say:
>>>> DO NOT TOUCH binary data.....
>>>>
>>>> Simply store it, or not, in your database.....
>>> Well exactly. the question is how to get it in there reliably using the
>>> PHP API.
>>>
>>>
>>
>>
>> When reading file contents, i see no need to do a mysqli_real_escape.
>>
>> <?php
>>   $link = mysqli_connect("localhost","test","test","test") or
>> die("Error " . mysqli_error($link));
>>
>>   $query = "CREATE TABLE `testpng` ( `id` int(11) NOT NULL
>> AUTO_INCREMENT, `image` blob, PRIMARY KEY (`id`))";
>>   $result = $link->query($query);
>>
>>   if (!$result) { echo "Could not create table....\n"; exit; } else {
>>     $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>>     $file = file_get_contents('upArrow.png');
>>     echo "Size before: ".strlen($file)."<br>\n";
>>     $stmt->bind_param('s', $file);
>>     $stmt->execute();
>>     printf("%d Row inserted.\n", $stmt->affected_rows);
>>     $stmt->close();
>>
>>     $stmt = $link->query("SELECT image FROM testpng;");
>>     $row = $stmt->fetch_object();
>>     $file = $row->image;
>>     echo "Size before: ".strlen($file)."<br>\n";
>>   }
>> ?>
> ..and hope that the file 'upArrow.png' does not contain a ['] or three?
>

luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
Binary file upArrow.png matches

luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27 
|S....`.cb..P-.`'|
00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10 
|..j>.{.-.]c..K'.|
000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32 
|Q.'"..K.&.....b2|
000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12 
|7$..C2'...I..T..|
00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7 
|...A.J'\'Gg.....|
00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27 
|..P~....a.a..~.'|
000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc 
|..5y$.3.,...'...|
000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd 
|...zo.......~r'.|
000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41 
|....w'...O._.@.A|


Yes it does, but who cares?

Are you really that afraid for code-insertion, that you fail to know 
that this cannot go wrong?

Or can you explain me how i can kill my database with this?

[toc] | [prev] | [next] | [standalone]

#10248

From	Luuk <luuk@invalid.lan>
Date	2013-07-27 17:34 +0200
Message-ID	<ss5dca-5ip.ln1@luuk.invalid.lan>
In reply to	#10247


Even if i add the following function:
function fwrite_stream($fp, $string) {
     for ($written = 0; $written < strlen($string); $written += $fwrite) {
         $fwrite = fwrite($fp, substr($string, $written));
         if ($fwrite === false) {
             return $written;
         }
     }
     return $written;
}

and at the end of my code:
$fp = fopen('NewUpArrow.png','wb');
fwrite_stream($fp, $file);


Then i can see that i created a copy of the original file:
luuk@opensuse:~> diff -s upArrow.png NewUpArrow.png
Files upArrow.png and NewUpArrow.png are identical

[toc] | [prev] | [next] | [standalone]

#10252

From	Jerry Stuckle <jstucklex@attglobal.net>
Date	2013-07-27 19:44 -0400
Message-ID	<kt1lk6$s80$1@dont-email.me>
In reply to	#10247

On 7/27/2013 11:22 AM, Luuk wrote:
> On 27-07-2013 16:36, The Natural Philosopher wrote:
>> On 27/07/13 14:28, Luuk wrote:
>>> On 27-07-2013 13:08, The Natural Philosopher wrote:
>>>> On 27/07/13 10:45, Luuk wrote:
>>>>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>>>>>> The target is to create and store thumbnail PNG images in a Mysql
>>>>>> table.
>>>>>> Also any tips on actually getting the thumbnail data into a
>>>>>> variable -
>>>>>> which package is recommended? I've always used GD, but never been
>>>>>> 100%
>>>>>> happy with it
>>>>>>
>>>>>
>>>>> As far as the subject goes, i would say:
>>>>> DO NOT TOUCH binary data.....
>>>>>
>>>>> Simply store it, or not, in your database.....
>>>> Well exactly. the question is how to get it in there reliably using the
>>>> PHP API.
>>>>
>>>>
>>>
>>>
>>> When reading file contents, i see no need to do a mysqli_real_escape.
>>>
>>> <?php
>>>   $link = mysqli_connect("localhost","test","test","test") or
>>> die("Error " . mysqli_error($link));
>>>
>>>   $query = "CREATE TABLE `testpng` ( `id` int(11) NOT NULL
>>> AUTO_INCREMENT, `image` blob, PRIMARY KEY (`id`))";
>>>   $result = $link->query($query);
>>>
>>>   if (!$result) { echo "Could not create table....\n"; exit; } else {
>>>     $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>>>     $file = file_get_contents('upArrow.png');
>>>     echo "Size before: ".strlen($file)."<br>\n";
>>>     $stmt->bind_param('s', $file);
>>>     $stmt->execute();
>>>     printf("%d Row inserted.\n", $stmt->affected_rows);
>>>     $stmt->close();
>>>
>>>     $stmt = $link->query("SELECT image FROM testpng;");
>>>     $row = $stmt->fetch_object();
>>>     $file = $row->image;
>>>     echo "Size before: ".strlen($file)."<br>\n";
>>>   }
>>> ?>
>> ..and hope that the file 'upArrow.png' does not contain a ['] or three?
>>
>
> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
> Binary file upArrow.png matches
>
> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
> |S....`.cb..P-.`'|
> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
> |..j>.{.-.]c..K'.|
> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
> |Q.'"..K.&.....b2|
> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
> |7$..C2'...I..T..|
> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
> |...A.J'\'Gg.....|
> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
> |..P~....a.a..~.'|
> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
> |..5y$.3.,...'...|
> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
> |...zo.......~r'.|
> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
> |....w'...O._.@.A|
>
>
> Yes it does, but who cares?
>
> Are you really that afraid for code-insertion, that you fail to know
> that this cannot go wrong?
>
> Or can you explain me how i can kill my database with this?
>

Insert the data without using prepared statements or 
mysql_real_escape_string().  Then don't check the return code.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10271

From	Luuk <luuk@invalid.lan>
Date	2013-07-28 14:54 +0200
Message-ID	<isgfca-6kg.ln1@luuk.invalid.lan>
In reply to	#10252

On 28-07-2013 01:44, Jerry Stuckle wrote:
> On 7/27/2013 11:22 AM, Luuk wrote:
>> On 27-07-2013 16:36, The Natural Philosopher wrote:
>>> On 27/07/13 14:28, Luuk wrote:
>>>> On 27-07-2013 13:08, The Natural Philosopher wrote:
>>>>> On 27/07/13 10:45, Luuk wrote:
>>>>>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>>>>>>> The target is to create and store thumbnail PNG images in a Mysql
>>>>>>> table.
>>>>>>> Also any tips on actually getting the thumbnail data into a
>>>>>>> variable -
>>>>>>> which package is recommended? I've always used GD, but never been
>>>>>>> 100%
>>>>>>> happy with it
>>>>>>>
>>>>>>
>>>>>> As far as the subject goes, i would say:
>>>>>> DO NOT TOUCH binary data.....
>>>>>>
>>>>>> Simply store it, or not, in your database.....
>>>>> Well exactly. the question is how to get it in there reliably using
>>>>> the
>>>>> PHP API.
>>>>>
>>>>>
>>>>
>>>>
>>>> When reading file contents, i see no need to do a mysqli_real_escape.
>>>>
>>>> <?php
>>>>   $link = mysqli_connect("localhost","test","test","test") or
>>>> die("Error " . mysqli_error($link));
>>>>
>>>>   $query = "CREATE TABLE `testpng` ( `id` int(11) NOT NULL
>>>> AUTO_INCREMENT, `image` blob, PRIMARY KEY (`id`))";
>>>>   $result = $link->query($query);
>>>>
>>>>   if (!$result) { echo "Could not create table....\n"; exit; } else {
>>>>     $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>>>>     $file = file_get_contents('upArrow.png');
>>>>     echo "Size before: ".strlen($file)."<br>\n";
>>>>     $stmt->bind_param('s', $file);
>>>>     $stmt->execute();
>>>>     printf("%d Row inserted.\n", $stmt->affected_rows);
>>>>     $stmt->close();
>>>>
>>>>     $stmt = $link->query("SELECT image FROM testpng;");
>>>>     $row = $stmt->fetch_object();
>>>>     $file = $row->image;
>>>>     echo "Size before: ".strlen($file)."<br>\n";
>>>>   }
>>>> ?>
>>> ..and hope that the file 'upArrow.png' does not contain a ['] or three?
>>>
>>
>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>> Binary file upArrow.png matches
>>
>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>> |S....`.cb..P-.`'|
>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>> |..j>.{.-.]c..K'.|
>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>> |Q.'"..K.&.....b2|
>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>> |7$..C2'...I..T..|
>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>> |...A.J'\'Gg.....|
>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>> |..P~....a.a..~.'|
>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>> |..5y$.3.,...'...|
>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>> |...zo.......~r'.|
>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>> |....w'...O._.@.A|
>>
>>
>> Yes it does, but who cares?
>>
>> Are you really that afraid for code-insertion, that you fail to know
>> that this cannot go wrong?
>>
>> Or can you explain me how i can kill my database with this?
>>
>
> Insert the data without using prepared statements or
> mysql_real_escape_string().
>
>

I think i was using a prepared statement.
And i wonder why i need to check if the contents of this png-file is 
really a png-file, or maybe a script. I'm not executing any code that 
MIGHT be stored in this file. I'm just storing the contents of that file 
in some blob.

> Then don't check the return code.

I did not check return code because this was a piece of example, 
normally is would check return code to see if storing was successful...

[toc] | [prev] | [next] | [standalone]

#10272

From	"J.O. Aho" <user@example.net>
Date	2013-07-28 15:35 +0200
Message-ID	<b5kl0cFss7gU1@mid.individual.net>
In reply to	#10271

On 28/07/13 14:54, Luuk wrote:

> I think i was using a prepared statement.
> And i wonder why i need to check if the contents of this png-file is
> really a png-file, or maybe a script. I'm not executing any code that
> MIGHT be stored in this file. I'm just storing the contents of that file
> in some blob.

If you worry that the image data includes something that may cause the 
database do something else than just insert the image, then see to 
base64 encode it first, this way you will not be affected by the 
content, of course you make things a bit more "heavy" for the system as 
you will need to decode the blob each time you want to use the image, 
but then if you use some sort of cache then you can store the decoded 
blob in the cache and use it as long as it residence there.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#10274

From	Jerry Stuckle <jstucklex@attglobal.net>
Date	2013-07-28 09:39 -0400
Message-ID	<kt36ib$4g8$2@dont-email.me>
In reply to	#10271

On 7/28/2013 8:54 AM, Luuk wrote:
> On 28-07-2013 01:44, Jerry Stuckle wrote:
>> On 7/27/2013 11:22 AM, Luuk wrote:
>>> On 27-07-2013 16:36, The Natural Philosopher wrote:
>>>> On 27/07/13 14:28, Luuk wrote:
>>>>> On 27-07-2013 13:08, The Natural Philosopher wrote:
>>>>>> On 27/07/13 10:45, Luuk wrote:
>>>>>>> On 27-07-2013 11:31, The Natural Philosopher wrote:
>>>>>>>> The target is to create and store thumbnail PNG images in a Mysql
>>>>>>>> table.
>>>>>>>> Also any tips on actually getting the thumbnail data into a
>>>>>>>> variable -
>>>>>>>> which package is recommended? I've always used GD, but never been
>>>>>>>> 100%
>>>>>>>> happy with it
>>>>>>>>
>>>>>>>
>>>>>>> As far as the subject goes, i would say:
>>>>>>> DO NOT TOUCH binary data.....
>>>>>>>
>>>>>>> Simply store it, or not, in your database.....
>>>>>> Well exactly. the question is how to get it in there reliably using
>>>>>> the
>>>>>> PHP API.
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>> When reading file contents, i see no need to do a mysqli_real_escape.
>>>>>
>>>>> <?php
>>>>>   $link = mysqli_connect("localhost","test","test","test") or
>>>>> die("Error " . mysqli_error($link));
>>>>>
>>>>>   $query = "CREATE TABLE `testpng` ( `id` int(11) NOT NULL
>>>>> AUTO_INCREMENT, `image` blob, PRIMARY KEY (`id`))";
>>>>>   $result = $link->query($query);
>>>>>
>>>>>   if (!$result) { echo "Could not create table....\n"; exit; } else {
>>>>>     $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>>>>>     $file = file_get_contents('upArrow.png');
>>>>>     echo "Size before: ".strlen($file)."<br>\n";
>>>>>     $stmt->bind_param('s', $file);
>>>>>     $stmt->execute();
>>>>>     printf("%d Row inserted.\n", $stmt->affected_rows);
>>>>>     $stmt->close();
>>>>>
>>>>>     $stmt = $link->query("SELECT image FROM testpng;");
>>>>>     $row = $stmt->fetch_object();
>>>>>     $file = $row->image;
>>>>>     echo "Size before: ".strlen($file)."<br>\n";
>>>>>   }
>>>>> ?>
>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or three?
>>>>
>>>
>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>> Binary file upArrow.png matches
>>>
>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>> |S....`.cb..P-.`'|
>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>> |..j>.{.-.]c..K'.|
>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>> |Q.'"..K.&.....b2|
>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>> |7$..C2'...I..T..|
>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>> |...A.J'\'Gg.....|
>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>> |..P~....a.a..~.'|
>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>> |..5y$.3.,...'...|
>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>> |...zo.......~r'.|
>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>> |....w'...O._.@.A|
>>>
>>>
>>> Yes it does, but who cares?
>>>
>>> Are you really that afraid for code-insertion, that you fail to know
>>> that this cannot go wrong?
>>>
>>> Or can you explain me how i can kill my database with this?
>>>
>>
>> Insert the data without using prepared statements or
>> mysql_real_escape_string().
>>
>>
>
> I think i was using a prepared statement.
> And i wonder why i need to check if the contents of this png-file is
> really a png-file, or maybe a script. I'm not executing any code that
> MIGHT be stored in this file. I'm just storing the contents of that file
> in some blob.
>
>> Then don't check the return code.
>
> I did not check return code because this was a piece of example,
> normally is would check return code to see if storing was successful...
>
>

It doesn't make any difference.  The png could contain one or more 
delimiters, i.e. an apostrophe, which will cause a syntax error in a 
non-prepared statement.

Escaping strings is not just to prevent security leeks - it is also to 
ensure valid SQL.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10277

From	Luuk <luuk@invalid.lan>
Date	2013-07-28 17:25 +0200
Message-ID	<1ppfca-lqi.ln1@luuk.invalid.lan>
In reply to	#10274

On 28-07-2013 15:39, Jerry Stuckle wrote:
> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>> three?
>>>>>
>>>>
>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>> Binary file upArrow.png matches
>>>>
>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>> |S....`.cb..P-.`'|
>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>> |..j>.{.-.]c..K'.|
>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>> |Q.'"..K.&.....b2|
>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>> |7$..C2'...I..T..|
>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>> |...A.J'\'Gg.....|
>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>> |..P~....a.a..~.'|
>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>> |..5y$.3.,...'...|
>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>> |...zo.......~r'.|
>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>> |....w'...O._.@.A|
>>>>
>>>>
>
> It doesn't make any difference.  The png could contain one or more
> delimiters, i.e. an apostrophe, which will cause a syntax error in a
> non-prepared statement.

It DOES contain single-quotes (that is an apostophe?).
and that DOES NOT cause a syntax error,
because i'm using a prepared statement.

>
> Escaping strings is not just to prevent security leeks - it is also to
> ensure valid SQL.
>

I dont see any errors in the query.log or error.log of my MySQL 
installation (about updating this `testpng`-table).
Therefore i dont see a point in ensuring validity of an already valid SQL.

Can you give an example an file that would break my script?
The script is here: http://pastebin.com/5D8ZGEhy
My emailadress is: luuk34@gmail.com

I think i have shown that this script is working OK, and that there is 
no reason to do something with escaping string here.

[toc] | [prev] | [next] | [standalone]

#10289

From	Jerry Stuckle <jstucklex@attglobal.net>
Date	2013-07-28 15:05 -0400
Message-ID	<kt3pl9$gap$2@dont-email.me>
In reply to	#10277

On 7/28/2013 11:25 AM, Luuk wrote:
> On 28-07-2013 15:39, Jerry Stuckle wrote:
>> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>>> three?
>>>>>>
>>>>>
>>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>>> Binary file upArrow.png matches
>>>>>
>>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>>> |S....`.cb..P-.`'|
>>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>>> |..j>.{.-.]c..K'.|
>>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>>> |Q.'"..K.&.....b2|
>>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>>> |7$..C2'...I..T..|
>>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>>> |...A.J'\'Gg.....|
>>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>>> |..P~....a.a..~.'|
>>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>>> |..5y$.3.,...'...|
>>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>>> |...zo.......~r'.|
>>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>>> |....w'...O._.@.A|
>>>>>
>>>>>
>>
>> It doesn't make any difference.  The png could contain one or more
>> delimiters, i.e. an apostrophe, which will cause a syntax error in a
>> non-prepared statement.
>
> It DOES contain single-quotes (that is an apostophe?).
> and that DOES NOT cause a syntax error,
> because i'm using a prepared statement.
>
>>
>> Escaping strings is not just to prevent security leeks - it is also to
>> ensure valid SQL.
>>
>
> I dont see any errors in the query.log or error.log of my MySQL
> installation (about updating this `testpng`-table).
> Therefore i dont see a point in ensuring validity of an already valid SQL.
>
> Can you give an example an file that would break my script?
> The script is here: http://pastebin.com/5D8ZGEhy
> My emailadress is: luuk34@gmail.com
>
> I think i have shown that this script is working OK, and that there is
> no reason to do something with escaping string here.
>

You're not reading my replies, Luuk.  I said if it contains delimiters 
and YOU ARE NOT USING PREPARED STATEMENTS.  For instance:

"INSERT INTO MyTABLE (bin_column) VALUES ('$png_data');

Prepared statements are good for some things - but you have to also be 
aware of the additional processing required when you use them.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10291

From	Luuk <luuk@invalid.lan>
Date	2013-07-28 21:16 +0200
Message-ID	<097gca-1mo.ln1@luuk.invalid.lan>
In reply to	#10289

On 28-07-2013 21:05, Jerry Stuckle wrote:
> On 7/28/2013 11:25 AM, Luuk wrote:
>> On 28-07-2013 15:39, Jerry Stuckle wrote:
>>> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>>>> three?
>>>>>>>
>>>>>>
>>>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>>>> Binary file upArrow.png matches
>>>>>>
>>>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>>>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>>>> |S....`.cb..P-.`'|
>>>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>>>> |..j>.{.-.]c..K'.|
>>>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>>>> |Q.'"..K.&.....b2|
>>>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>>>> |7$..C2'...I..T..|
>>>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>>>> |...A.J'\'Gg.....|
>>>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>>>> |..P~....a.a..~.'|
>>>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>>>> |..5y$.3.,...'...|
>>>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>>>> |...zo.......~r'.|
>>>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>>>> |....w'...O._.@.A|
>>>>>>
>>>>>>
>>>
>>> It doesn't make any difference.  The png could contain one or more
>>> delimiters, i.e. an apostrophe, which will cause a syntax error in a
>>> non-prepared statement.
>>
>> It DOES contain single-quotes (that is an apostophe?).
>> and that DOES NOT cause a syntax error,
>> because i'm using a prepared statement.
>>
>>>
>>> Escaping strings is not just to prevent security leeks - it is also to
>>> ensure valid SQL.
>>>
>>
>> I dont see any errors in the query.log or error.log of my MySQL
>> installation (about updating this `testpng`-table).
>> Therefore i dont see a point in ensuring validity of an already valid
>> SQL.
>>
>> Can you give an example an file that would break my script?
>> The script is here: http://pastebin.com/5D8ZGEhy
>> My emailadress is: luuk34@gmail.com
>>
>> I think i have shown that this script is working OK, and that there is
>> no reason to do something with escaping string here.
>>
>
> You're not reading my replies, Luuk.  I said if it contains delimiters
> and YOU ARE NOT USING PREPARED STATEMENTS.  For instance:
>
> "INSERT INTO MyTABLE (bin_column) VALUES ('$png_data');
>
> Prepared statements are good for some things - but you have to also be
> aware of the additional processing required when you use them.
>
>

 From my code (at: http://pastebin.com/5D8ZGEhy):
   $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
     $file = file_get_contents('upArrow.png');
     echo "Size before: ".strlen($file)."<br>\n";
     $stmt->bind_param('s', $file);

Is above not a prepared statment?

[toc] | [prev] | [next] | [standalone]

#10292

From	Jerry Stuckle <jstucklex@attglobal.net>
Date	2013-07-28 20:46 -0400
Message-ID	<kt4dle$me9$1@dont-email.me>
In reply to	#10291

On 7/28/2013 3:16 PM, Luuk wrote:
> On 28-07-2013 21:05, Jerry Stuckle wrote:
>> On 7/28/2013 11:25 AM, Luuk wrote:
>>> On 28-07-2013 15:39, Jerry Stuckle wrote:
>>>> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>>>>> three?
>>>>>>>>
>>>>>>>
>>>>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>>>>> Binary file upArrow.png matches
>>>>>>>
>>>>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep "'"
>>>>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>>>>> |S....`.cb..P-.`'|
>>>>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>>>>> |..j>.{.-.]c..K'.|
>>>>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>>>>> |Q.'"..K.&.....b2|
>>>>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>>>>> |7$..C2'...I..T..|
>>>>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>>>>> |...A.J'\'Gg.....|
>>>>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>>>>> |..P~....a.a..~.'|
>>>>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>>>>> |..5y$.3.,...'...|
>>>>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>>>>> |...zo.......~r'.|
>>>>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>>>>> |....w'...O._.@.A|
>>>>>>>
>>>>>>>
>>>>
>>>> It doesn't make any difference.  The png could contain one or more
>>>> delimiters, i.e. an apostrophe, which will cause a syntax error in a
>>>> non-prepared statement.
>>>
>>> It DOES contain single-quotes (that is an apostophe?).
>>> and that DOES NOT cause a syntax error,
>>> because i'm using a prepared statement.
>>>
>>>>
>>>> Escaping strings is not just to prevent security leeks - it is also to
>>>> ensure valid SQL.
>>>>
>>>
>>> I dont see any errors in the query.log or error.log of my MySQL
>>> installation (about updating this `testpng`-table).
>>> Therefore i dont see a point in ensuring validity of an already valid
>>> SQL.
>>>
>>> Can you give an example an file that would break my script?
>>> The script is here: http://pastebin.com/5D8ZGEhy
>>> My emailadress is: luuk34@gmail.com
>>>
>>> I think i have shown that this script is working OK, and that there is
>>> no reason to do something with escaping string here.
>>>
>>
>> You're not reading my replies, Luuk.  I said if it contains delimiters
>> and YOU ARE NOT USING PREPARED STATEMENTS.  For instance:
>>
>> "INSERT INTO MyTABLE (bin_column) VALUES ('$png_data');
>>
>> Prepared statements are good for some things - but you have to also be
>> aware of the additional processing required when you use them.
>>
>>
>
>  From my code (at: http://pastebin.com/5D8ZGEhy):
>    $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>      $file = file_get_contents('upArrow.png');
>      echo "Size before: ".strlen($file)."<br>\n";
>      $stmt->bind_param('s', $file);
>
> Is above not a prepared statment?
>

Luuk, yes it is.  But READ WHAT I'VE BEEN SAYING!

I NEVER SAID YOU WERE NOT USING PREPARED STATEMENTS!


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10295

From	Daniel Pitts <newsgroup.nospam@virtualinfinity.net>
Date	2013-07-29 09:17 -0700
Message-ID	<7AwJt.296856$aW2.295134@fx13.iad>
In reply to	#10292

On 7/28/13 5:46 PM, Jerry Stuckle wrote:
> On 7/28/2013 3:16 PM, Luuk wrote:
>> On 28-07-2013 21:05, Jerry Stuckle wrote:
>>> On 7/28/2013 11:25 AM, Luuk wrote:
>>>> On 28-07-2013 15:39, Jerry Stuckle wrote:
>>>>> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>>>>>> three?
>>>>>>>>>
>>>>>>>>
>>>>>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>>>>>> Binary file upArrow.png matches
>>>>>>>>
>>>>>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep
>>>>>>>> "'"
>>>>>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>>>>>> |S....`.cb..P-.`'|
>>>>>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>>>>>> |..j>.{.-.]c..K'.|
>>>>>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>>>>>> |Q.'"..K.&.....b2|
>>>>>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>>>>>> |7$..C2'...I..T..|
>>>>>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>>>>>> |...A.J'\'Gg.....|
>>>>>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>>>>>> |..P~....a.a..~.'|
>>>>>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>>>>>> |..5y$.3.,...'...|
>>>>>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>>>>>> |...zo.......~r'.|
>>>>>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>>>>>> |....w'...O._.@.A|
>>>>>>>>
>>>>>>>>
>>>>>
>>>>> It doesn't make any difference.  The png could contain one or more
>>>>> delimiters, i.e. an apostrophe, which will cause a syntax error in a
>>>>> non-prepared statement.
>>>>
>>>> It DOES contain single-quotes (that is an apostophe?).
>>>> and that DOES NOT cause a syntax error,
>>>> because i'm using a prepared statement.
>>>>
>>>>>
>>>>> Escaping strings is not just to prevent security leeks - it is also to
>>>>> ensure valid SQL.
>>>>>
>>>>
>>>> I dont see any errors in the query.log or error.log of my MySQL
>>>> installation (about updating this `testpng`-table).
>>>> Therefore i dont see a point in ensuring validity of an already valid
>>>> SQL.
>>>>
>>>> Can you give an example an file that would break my script?
>>>> The script is here: http://pastebin.com/5D8ZGEhy
>>>> My emailadress is: luuk34@gmail.com
>>>>
>>>> I think i have shown that this script is working OK, and that there is
>>>> no reason to do something with escaping string here.
>>>>
>>>
>>> You're not reading my replies, Luuk.  I said if it contains delimiters
>>> and YOU ARE NOT USING PREPARED STATEMENTS.  For instance:
>>>
>>> "INSERT INTO MyTABLE (bin_column) VALUES ('$png_data');
>>>
>>> Prepared statements are good for some things - but you have to also be
>>> aware of the additional processing required when you use them.
If you're concerned about additional processing, then you shouldn't be 
using PHP in the first place :-)  Chances are there are aspects of the 
program which use more resources than prepared statements.

I would posit that one should use prepared statements for everything, 
*unless* there is a critical performance requirement which cannot be met 
with them *and* you can provide for safe data.

Profiling is necessary for determining performance penalty, and rigorous 
analysis is required for the safety. So, only highly skilled 
professionals with the appropriate tools should consider eschewing 
prepared statements. It seems to be an unfortunate reversal, where most 
highly skilled professionals always use prepared statements, and 
amateurs and students unwittingly use unsafe alternatives.

>>>
>>>
>>
>>  From my code (at: http://pastebin.com/5D8ZGEhy):
>>    $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>>      $file = file_get_contents('upArrow.png');
>>      echo "Size before: ".strlen($file)."<br>\n";
>>      $stmt->bind_param('s', $file);
>>
>> Is above not a prepared statment?
Luuk, I understand why you think Jerry was criticizing your code, but I 
don't believe he was.  Your code is fine WRT SQL injection.

>
> Luuk, yes it is.  But READ WHAT I'VE BEEN SAYING!
>
> I NEVER SAID YOU WERE NOT USING PREPARED STATEMENTS!
Jerry, I understand why you are making a point about SQL injection, but 
in the context, it comes across as a criticism of Luuk's code, which 
actually is correct, and escaping would actually cause problems.

[toc] | [prev] | [next] | [standalone]

#10296

From	Jerry Stuckle <jstucklex@attglobal.net>
Date	2013-07-29 14:01 -0400
Message-ID	<kt6aa8$mf8$1@dont-email.me>
In reply to	#10295

On 7/29/2013 12:17 PM, Daniel Pitts wrote:
> On 7/28/13 5:46 PM, Jerry Stuckle wrote:
>> On 7/28/2013 3:16 PM, Luuk wrote:
>>> On 28-07-2013 21:05, Jerry Stuckle wrote:
>>>> On 7/28/2013 11:25 AM, Luuk wrote:
>>>>> On 28-07-2013 15:39, Jerry Stuckle wrote:
>>>>>> On 7/28/2013 8:54 AM, Luuk wrote:
>>>>>>>>>> ..and hope that the file 'upArrow.png' does not contain a ['] or
>>>>>>>>>> three?
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>> luuk@opensuse:~/public_html/temp> grep "'" upArrow.png
>>>>>>>>> Binary file upArrow.png matches
>>>>>>>>>
>>>>>>>>> luuk@opensuse:~/public_html/temp> hexdump -C upArrow.png  | grep
>>>>>>>>> "'"
>>>>>>>>> 00000110  53 00 a0 04 00 60 cb 63  62 e3 00 50 2d 00 60 27
>>>>>>>>> |S....`.cb..P-.`'|
>>>>>>>>> 00000260  00 b0 6a 3e 01 7b 91 2d  a8 5d 63 03 f6 4b 27 10
>>>>>>>>> |..j>.{.-.]c..K'.|
>>>>>>>>> 000003a0  51 c2 27 22 93 a8 4b b4  26 ba 11 f9 c4 18 62 32
>>>>>>>>> |Q.'"..K.&.....b2|
>>>>>>>>> 000003c0  37 24 12 89 43 32 27 b9  90 02 49 b1 a4 54 d2 12
>>>>>>>>> |7$..C2'...I..T..|
>>>>>>>>> 00000530  fb 81 0e 41 c7 4a 27 5c  27 47 67 8f ce 05 9d e7
>>>>>>>>> |...A.J'\'Gg.....|
>>>>>>>>> 00000720  0e 85 50 7e e8 d6 d0 07  61 e6 61 8b c3 7e 0c 27
>>>>>>>>> |..P~....a.a..~.'|
>>>>>>>>> 000007c0  91 bc 35 79 24 c5 33 a5  2c e5 b9 84 27 a9 90 bc
>>>>>>>>> |..5y$.3.,...'...|
>>>>>>>>> 000009e0  dd bd f3 7a 6f f7 c5 f7  f5 df 16 dd 7e 72 27 fd
>>>>>>>>> |...zo.......~r'.|
>>>>>>>>> 000009f0  ce cb bb d9 77 27 ee ad  bc 4f bc 5f f4 40 ed 41
>>>>>>>>> |....w'...O._.@.A|
>>>>>>>>>
>>>>>>>>>
>>>>>>
>>>>>> It doesn't make any difference.  The png could contain one or more
>>>>>> delimiters, i.e. an apostrophe, which will cause a syntax error in a
>>>>>> non-prepared statement.
>>>>>
>>>>> It DOES contain single-quotes (that is an apostophe?).
>>>>> and that DOES NOT cause a syntax error,
>>>>> because i'm using a prepared statement.
>>>>>
>>>>>>
>>>>>> Escaping strings is not just to prevent security leeks - it is
>>>>>> also to
>>>>>> ensure valid SQL.
>>>>>>
>>>>>
>>>>> I dont see any errors in the query.log or error.log of my MySQL
>>>>> installation (about updating this `testpng`-table).
>>>>> Therefore i dont see a point in ensuring validity of an already valid
>>>>> SQL.
>>>>>
>>>>> Can you give an example an file that would break my script?
>>>>> The script is here: http://pastebin.com/5D8ZGEhy
>>>>> My emailadress is: luuk34@gmail.com
>>>>>
>>>>> I think i have shown that this script is working OK, and that there is
>>>>> no reason to do something with escaping string here.
>>>>>
>>>>
>>>> You're not reading my replies, Luuk.  I said if it contains delimiters
>>>> and YOU ARE NOT USING PREPARED STATEMENTS.  For instance:
>>>>
>>>> "INSERT INTO MyTABLE (bin_column) VALUES ('$png_data');
>>>>
>>>> Prepared statements are good for some things - but you have to also be
>>>> aware of the additional processing required when you use them.
> If you're concerned about additional processing, then you shouldn't be
> using PHP in the first place :-)  Chances are there are aspects of the
> program which use more resources than prepared statements.
>
> I would posit that one should use prepared statements for everything,
> *unless* there is a critical performance requirement which cannot be met
> with them *and* you can provide for safe data.
>
> Profiling is necessary for determining performance penalty, and rigorous
> analysis is required for the safety. So, only highly skilled
> professionals with the appropriate tools should consider eschewing
> prepared statements. It seems to be an unfortunate reversal, where most
> highly skilled professionals always use prepared statements, and
> amateurs and students unwittingly use unsafe alternatives.
>
>>>>
>>>>
>>>
>>>  From my code (at: http://pastebin.com/5D8ZGEhy):
>>>    $stmt = $link->prepare("INSERT INTO testpng (image)  VALUES (?)");
>>>      $file = file_get_contents('upArrow.png');
>>>      echo "Size before: ".strlen($file)."<br>\n";
>>>      $stmt->bind_param('s', $file);
>>>
>>> Is above not a prepared statment?
> Luuk, I understand why you think Jerry was criticizing your code, but I
> don't believe he was.  Your code is fine WRT SQL injection.
>
>>
>> Luuk, yes it is.  But READ WHAT I'VE BEEN SAYING!
>>
>> I NEVER SAID YOU WERE NOT USING PREPARED STATEMENTS!
> Jerry, I understand why you are making a point about SQL injection, but
> in the context, it comes across as a criticism of Luuk's code, which
> actually is correct, and escaping would actually cause problems.
>

Sorry, I do not mean to criticize Luuk's code - in fact, I have 
specifically tried NOT to criticize his code.  I was only referring to 
code which does NOT use prepared statements.  It has nothing to do with 
how he's writing his code.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10300

From	The Natural Philosopher <tnp@invalid.invalid>
Date	2013-07-30 00:04 +0100
Message-ID	<kt6sde$obj$1@news.albasani.net>
In reply to	#10295

Further to this thread I THINK I have established a third way to get 
clean binary data into a blob.
I looked at what phpmyadmin was doing and developed this code.
( it's just the relevant fragment. Its a screen to upload a single file 
and some other form stuff and update the  SQL record. )
====================
     if($_FILES['uploaded_file']['error']!="")
         {
         $havefile=FALSE;
         }
     else
         {
$code=file_get_contents($_FILES['uploaded_file']['tmp_name']);
         $size=$_FILES['uploaded_file']['size'];
         $filename=$_FILES['uploaded_file']['name'];
         $havefile=TRUE;
         }
     if (($id=get_id())>0) // its an update
         {
         if($havefile)
             $query=sprintf("update adminmodule set uri='%s', 
descr='%s', privilege_level='%d', filename='%s', size='%d', code=0x%s, 
modified_by='%d', modified_on=now() where id='%d'",
$_POST['uri'],$_POST['descr'],$_POST['privilege_level'],$filename, 
$size, bin2hex($code), $login_id,$id);
         else
             $query=sprintf("update adminmodule set uri='%s', 
descr='%s', privilege_level='%d', modified_by='%d', modified_on=now() 
where id='%d'",
$_POST['uri'],$_POST['descr'],$_POST['privilege_level'],$login_id,$id);
         mysqli_query($link,$query);
         }
=======================
That is, if you have a variable with binary  data in it, run bin2hex() 
on it and prepend '0x' to it and throw it at a simple sql update or 
insert statement.

I didnt know MySQL accepted hex data in that form.

Not as efficient as a prepared statement for big objects, but  its 
simple to understand.  And it avoids load_file.

In this case its optimal. The code is simple, no FILE privileges are 
required. Since inserts and updates are rare things done by a few people 
the inefficiency  won't load up the server hugely.

-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10301

From	Jerry Stuckle <jstucklex@attglobal.net>
Date	2013-07-29 21:02 -0400
Message-ID	<kt72vo$vmi$1@dont-email.me>
In reply to	#10300

On 7/29/2013 7:04 PM, The Natural Philosopher wrote:
> Further to this thread I THINK I have established a third way to get
> clean binary data into a blob.
> I looked at what phpmyadmin was doing and developed this code.
> ( it's just the relevant fragment. Its a screen to upload a single file
> and some other form stuff and update the  SQL record. )
> ====================
>      if($_FILES['uploaded_file']['error']!="")
>          {
>          $havefile=FALSE;
>          }
>      else
>          {
> $code=file_get_contents($_FILES['uploaded_file']['tmp_name']);
>          $size=$_FILES['uploaded_file']['size'];
>          $filename=$_FILES['uploaded_file']['name'];
>          $havefile=TRUE;
>          }
>      if (($id=get_id())>0) // its an update
>          {
>          if($havefile)
>              $query=sprintf("update adminmodule set uri='%s',
> descr='%s', privilege_level='%d', filename='%s', size='%d', code=0x%s,
> modified_by='%d', modified_on=now() where id='%d'",
> $_POST['uri'],$_POST['descr'],$_POST['privilege_level'],$filename,
> $size, bin2hex($code), $login_id,$id);
>          else
>              $query=sprintf("update adminmodule set uri='%s',
> descr='%s', privilege_level='%d', modified_by='%d', modified_on=now()
> where id='%d'",
> $_POST['uri'],$_POST['descr'],$_POST['privilege_level'],$login_id,$id);
>          mysqli_query($link,$query);
>          }
> =======================
> That is, if you have a variable with binary  data in it, run bin2hex()
> on it and prepend '0x' to it and throw it at a simple sql update or
> insert statement.
>
> I didnt know MySQL accepted hex data in that form.
>
> Not as efficient as a prepared statement for big objects, but  its
> simple to understand.  And it avoids load_file.
>
> In this case its optimal. The code is simple, no FILE privileges are
> required. Since inserts and updates are rare things done by a few people
> the inefficiency  won't load up the server hugely.
>

A beautiful way to ensure your database gets hacked (not cleaning the 
$_POST data before trying to insert into the database).


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10297

From	Luuk <luuk@invalid.lan>
Date	2013-07-29 20:34 +0200
Message-ID	<46pica-6nf.ln1@luuk.invalid.lan>
In reply to	#10292

On 29-07-2013 02:46, Jerry Stuckle wrote:
> On 7/28/2013 3:16 PM, Luuk wrote:
>> On 28-07-2013 21:05, Jerry Stuckle wrote:
....

>>> and YOU ARE NOT USING PREPARED STATEMENTS.  For instance:
>>>
....
>
> I NEVER SAID YOU WERE NOT USING PREPARED STATEMENTS!
>
>


I must have been my understanding of English..... ;)

But i now know what you mean..., thanks

[toc] | [prev] | [next] | [standalone]

Page 1 of 2 [1] 2 Next page →

csiph-web

is mysqli_real_escape_string bullet proof with binary data?

Contents

#10234 — is mysqli_real_escape_string bullet proof with binary data?

#10235

#10236

#10237

#10245

#10247

#10248

#10252

#10271

#10272

#10274

#10277

#10289

#10291

#10292

#10295

#10296

#10300

#10301

#10297