Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10234 > unrolled thread

is mysqli_real_escape_string bullet proof with binary data?

Back to article view | Back to comp.lang.php

Contents

  is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 10:31 +0100
    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 11:45 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 12:08 +0100
        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:28 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:36 +0100
            Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:22 +0200
              Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 17:34 +0200
              Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 19:44 -0400
                Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 14:54 +0200
                  Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-28 15:35 +0200
                  Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 09:39 -0400
                    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 17:25 +0200
                      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 15:05 -0400
                        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-28 21:16 +0200
                          Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-28 20:46 -0400
                            Re: is mysqli_real_escape_string bullet proof with binary data? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-07-29 09:17 -0700
                              Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 14:01 -0400
                              Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-30 00:04 +0100
                                Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-29 21:02 -0400
                            Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:34 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:52 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-27 15:58 +0200
          Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:36 -0400
            Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 10:43 -0400
    Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 09:35 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:56 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? Norman Peelman <npeelman@cfl.rr.com> - 2013-07-27 20:01 -0400
      Re: is mysqli_real_escape_string bullet proof with binary data? The Natural Philosopher <tnp@invalid.invalid> - 2013-07-27 15:33 +0100
    Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-27 09:57 -0400
    I've always used GD, but never been 100% happy with it (Was: is mysqli_real_escape_string bullet proof with binary data?) "J.O. Aho" <user@example.net> - 2013-07-27 18:09 +0200
    Re: is mysqli_real_escape_string bullet proof with binary data? Luuk <luuk@invalid.lan> - 2013-07-29 20:37 +0200
      Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 07:31 +0200
        Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 02:08 -0400
          Re: is mysqli_real_escape_string bullet proof with binary data? Scott Johnson <noonehome@chalupasworld.com> - 2013-07-30 05:35 -0700
          Re: is mysqli_real_escape_string bullet proof with binary data? "J.O. Aho" <user@example.net> - 2013-07-30 17:53 +0200
            Re: is mysqli_real_escape_string bullet proof with binary data? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-30 12:37 -0400
        Re: is mysqli_real_escape_string bullet proof with binary data? tony@mountifield.org (Tony Mountifield) - 2013-07-30 09:35 +0000
      Re: is mysqli_real_escape_string bullet proof with binary data? Denis McMahon <denismfmcmahon@gmail.com> - 2013-07-31 04:56 +0000

Page 2 of 2 — ← Prev page 1 [2]

#10239

On 7/27/2013 5:45 AM, Luuk wrote:
> On 27-07-2013 11:31, The Natural Philosopher wrote:
>> The target is to create and store thumbnail PNG images in a Mysql table.
>> Also any tips on actually getting the thumbnail data into a variable -
>> which package is recommended? I've always used GD, but never been 100%
>> happy with it
>>
>
> As far as the subject goes, i would say:
> DO NOT TOUCH binary data.....
>
> Simply store it, or not, in your database.....

Bull.  Binary data works fine in a database - and storing it there has 
many advantages.  Easy backup and improved data integrity are just two 
of them.

A file system is just a database with a different means of access.  They 
both store bytes.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10242

On 27-07-2013 15:52, Jerry Stuckle wrote:
>> Simply store it, or not, in your database.....
>
> Bull.

I did not know that reading could be so hard... ;)

[toc] | [prev] | [next] | [standalone]

#10244

On 7/27/2013 9:58 AM, Luuk wrote:
> On 27-07-2013 15:52, Jerry Stuckle wrote:
>>> Simply store it, or not, in your database.....
>>
>> Bull.
>
> I did not know that reading could be so hard... ;)

It's not.  But

"DO NOT TOUCH binary data....."

Is completely incorrect.  Like all strings, it MUST be processed with 
mysql_real_escape_string() to get the correct data in the database.

However, I see that part got cut off in my reply.  Guess I shouldn't be 
trying to carry on a discussion with the wife while posting.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10246

On 7/27/2013 10:36 AM, Jerry Stuckle wrote:
> On 7/27/2013 9:58 AM, Luuk wrote:
>> On 27-07-2013 15:52, Jerry Stuckle wrote:
>>>> Simply store it, or not, in your database.....
>>>
>>> Bull.
>>
>> I did not know that reading could be so hard... ;)
>
> It's not.  But
>
> "DO NOT TOUCH binary data....."
>
> Is completely incorrect.  Like all strings, it MUST be processed with
> mysql_real_escape_string() to get the correct data in the database.
>
> However, I see that part got cut off in my reply.  Guess I shouldn't be
> trying to carry on a discussion with the wife while posting.
>

I should add you can use bound parameters instead - but beware that 
bound parameters create additional overhead.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10238

On 07/27/2013 05:31 AM, The Natural Philosopher wrote:
> The target is to create and store thumbnail PNG images in a Mysql table.
> Also any tips on actually getting the thumbnail data into a variable -
> which package is recommended? I've always used GD, but never been 100%
> happy with it
>

   Well, you don't sat why you don't like GD but that is what I use (on 
one of my sites) so here is what I do---

When writing *to* the database:
A) You have sql LOAD_FILE to store a file (filesystem) in the db.

    I write the GD image resource to a tmp file and then store it using
    LOAD_FILE.

    imagepng($img, $destfile);
    /* stuff */
    $query = "UPDATE table SET img_data = LOAD_FILE('$destfile') WHERE ?"

B) ??


When retrieving *from* the db:
A) The binary data is in the result set such that:

    header("Content-Type: image/png");
    echo $result['image_data']

    -or-

    You can create a GD image resource by using:

    $img = imagecreatefromstring($result['image_data']);
    /* GD manipulations */
    header("Content-Type: image/png");
    imagepng($img);

    either should output an image to the browser.

B) output_buffering lets you do some crazy stuff.


-or-

   Take a look at the Imagick module for PHP (PECL).

http://www.php.net/manual/en/imagick.getimageblob.php
http://www.php.net/manual/en/imagick.readimageblob.php
http://www.php.net/manual/en/imagick.readimagefile.php

-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

[toc] | [prev] | [next] | [standalone]

#10240

On 7/27/2013 9:35 AM, Norman Peelman wrote:
> On 07/27/2013 05:31 AM, The Natural Philosopher wrote:
>> The target is to create and store thumbnail PNG images in a Mysql table.
>> Also any tips on actually getting the thumbnail data into a variable -
>> which package is recommended? I've always used GD, but never been 100%
>> happy with it
>>
>
>    Well, you don't sat why you don't like GD but that is what I use (on
> one of my sites) so here is what I do---
>
> When writing *to* the database:
> A) You have sql LOAD_FILE to store a file (filesystem) in the db.
>
>     I write the GD image resource to a tmp file and then store it using
>     LOAD_FILE.
>
>     imagepng($img, $destfile);
>     /* stuff */
>     $query = "UPDATE table SET img_data = LOAD_FILE('$destfile') WHERE ?"
>

No, you do NOT have to write the image to a temp file and use LOAD FILE. 
  It can be written directly from the binary image in memory.

> B) ??
>
>
> When retrieving *from* the db:
> A) The binary data is in the result set such that:
>
>     header("Content-Type: image/png");
>     echo $result['image_data']
>
>     -or-
>
>     You can create a GD image resource by using:
>
>     $img = imagecreatefromstring($result['image_data']);
>     /* GD manipulations */
>     header("Content-Type: image/png");
>     imagepng($img);
>
>     either should output an image to the browser.
>
> B) output_buffering lets you do some crazy stuff.
>
>
> -or-
>
>    Take a look at the Imagick module for PHP (PECL).
>
> http://www.php.net/manual/en/imagick.getimageblob.php
> http://www.php.net/manual/en/imagick.readimageblob.php
> http://www.php.net/manual/en/imagick.readimagefile.php
>

Yes, the GD functions work, but imagick is much more flexible.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10258

On 07/27/2013 09:56 AM, Jerry Stuckle wrote:
> On 7/27/2013 9:35 AM, Norman Peelman wrote:
>> On 07/27/2013 05:31 AM, The Natural Philosopher wrote:
>>> The target is to create and store thumbnail PNG images in a Mysql table.
>>> Also any tips on actually getting the thumbnail data into a variable -
>>> which package is recommended? I've always used GD, but never been 100%
>>> happy with it
>>>
>>
>>    Well, you don't sat why you don't like GD but that is what I use (on
>> one of my sites) so here is what I do---
>>
>> When writing *to* the database:
>> A) You have sql LOAD_FILE to store a file (filesystem) in the db.
>>
>>     I write the GD image resource to a tmp file and then store it using
>>     LOAD_FILE.
>>
>>     imagepng($img, $destfile);
>>     /* stuff */
>>     $query = "UPDATE table SET img_data = LOAD_FILE('$destfile') WHERE ?"
>>
>
> No, you do NOT have to write the image to a temp file and use LOAD FILE.
>   It can be written directly from the binary image in memory.
>


   Thanks Jerry, never thought about trying that. My site only used 
small images 10kb or less in size and I think I was either processing 
them through shared memory (shm - linux) or I may have even just used 
the images straight from the POST array (after some verification). 
Probably not a good idea but I was just starting to learn PHP/MYSQL/HTML 
at the time, not that I've mastered anything...


-- 
Norman
Registered Linux user #461062
-Have you been to www.php.net yet?-

[toc] | [prev] | [next] | [standalone]

#10243

On 27/07/13 14:35, Norman Peelman wrote:
> On 07/27/2013 05:31 AM, The Natural Philosopher wrote:
>> The target is to create and store thumbnail PNG images in a Mysql table.
>> Also any tips on actually getting the thumbnail data into a variable -
>> which package is recommended? I've always used GD, but never been 100%
>> happy with it
>>
>
>   Well, you don't sat why you don't like GD but that is what I use (on 
> one of my sites) so here is what I do---
>
> When writing *to* the database:
> A) You have sql LOAD_FILE to store a file (filesystem) in the db.
>
>    I write the GD image resource to a tmp file and then store it using
>    LOAD_FILE.
>
>    imagepng($img, $destfile);
>    /* stuff */
>    $query = "UPDATE table SET img_data = LOAD_FILE('$destfile') WHERE ?"
>

that's what I have used in the past..
> B) ??
>
>
> When retrieving *from* the db:
> A) The binary data is in the result set such that:
>
>    header("Content-Type: image/png");
>    echo $result['image_data']
>
>    -or-
>
>    You can create a GD image resource by using:
>
>    $img = imagecreatefromstring($result['image_data']);
>    /* GD manipulations */
>    header("Content-Type: image/png");
>    imagepng($img);
>
>    either should output an image to the browser.
>
> B) output_buffering lets you do some crazy stuff.
>
>
> -or-
>
>   Take a look at the Imagick module for PHP (PECL).
>
I will. TIA

> http://www.php.net/manual/en/imagick.getimageblob.php
> http://www.php.net/manual/en/imagick.readimageblob.php
> http://www.php.net/manual/en/imagick.readimagefile.php
>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#10241

On 7/27/2013 5:31 AM, The Natural Philosopher wrote:
> The target is to create and store thumbnail PNG images in a Mysql table.
> Also any tips on actually getting the thumbnail data into a variable -
> which package is recommended? I've always used GD, but never been 100%
> happy with it
>

Pretty easy to do.  But I know you don't want to hear from me, so I 
won't bother telling you the right way to do it.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10249 — I've always used GD, but never been 100% happy with it (Was: is mysqli_real_escape_string bullet proof with binary data?)

On 27/07/13 11:31, The Natural Philosopher wrote:
> The target is to create and store thumbnail PNG images in a Mysql table.
> Also any tips on actually getting the thumbnail data into a variable -
> which package is recommended? I've always used GD, but never been 100%
> happy with it

If you ain't happy with GD, then use ImageMagick, if possible use the 
php extension and not the binaries with exec() which quite many seems to 
do. Using the extension you will notice it's far faster than using the 
binaries.

www.php.net/manual/en/book.imagick.php

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#10298

On 27-07-2013 11:31, The Natural Philosopher wrote:
> The target is to create and store thumbnail PNG images in a Mysql table.
> Also any tips on actually getting the thumbnail data into a variable -
> which package is recommended? I've always used GD, but never been 100%
> happy with it
>

BTW, why is this message cross-posted to 'comp.datbase.mysql'
it's a non-existing newsgroup......

;)

[toc] | [prev] | [next] | [standalone]

#10302

On 29/07/13 20:37, Luuk wrote:

> BTW, why is this message cross-posted to 'comp.datbase.mysql'

I think Denis thought the question was relevant for c.d.m (maybe it 
should have been posted in the inactive group alt.php.sql).


> it's a non-existing newsgroup......

Just for your service provider don't supply that news group, id do exist.


-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#10303

On 7/30/2013 1:31 AM, J.O. Aho wrote:
> On 29/07/13 20:37, Luuk wrote:
>
>> BTW, why is this message cross-posted to 'comp.datbase.mysql'
>
> I think Denis thought the question was relevant for c.d.m (maybe it
> should have been posted in the inactive group alt.php.sql).
>
>
>> it's a non-existing newsgroup......
>
> Just for your service provider don't supply that news group, id do exist.
>
>

My newsgroup provider doesn't carry comp.database.mysql, either.  It 
does, however, carry comp.databaseS.mysql.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10305

On 7/29/2013 11:08 PM, Jerry Stuckle wrote:
> On 7/30/2013 1:31 AM, J.O. Aho wrote:
>> On 29/07/13 20:37, Luuk wrote:
>>
>>> BTW, why is this message cross-posted to 'comp.datbase.mysql'
>>
>> I think Denis thought the question was relevant for c.d.m (maybe it
>> should have been posted in the inactive group alt.php.sql).
>>
>>
>>> it's a non-existing newsgroup......
>>
>> Just for your service provider don't supply that news group, id do exist.
>>
>>
>
> My newsgroup provider doesn't carry comp.database.mysql, either.  It
> does, however, carry comp.databaseS.mysql.
>

Ditto

[toc] | [prev] | [next] | [standalone]

#10306

On 30/07/13 08:08, Jerry Stuckle wrote:
> On 7/30/2013 1:31 AM, J.O. Aho wrote:
>> On 29/07/13 20:37, Luuk wrote:
>>
>>> BTW, why is this message cross-posted to 'comp.datbase.mysql'
>>
>> I think Denis thought the question was relevant for c.d.m (maybe it
>> should have been posted in the inactive group alt.php.sql).
>>
>>
>>> it's a non-existing newsgroup......
>>
>> Just for your service provider don't supply that news group, id do exist.
>>
>>
>
> My newsgroup provider doesn't carry comp.database.mysql, either.  It
> does, however, carry comp.databaseS.mysql.

I could try to blame it was still early in the morning for me... just 
didn't check the spelling that closely.

[toc] | [prev] | [next] | [standalone]

#10307

On 7/30/2013 11:53 AM, J.O. Aho wrote:
> On 30/07/13 08:08, Jerry Stuckle wrote:
>> On 7/30/2013 1:31 AM, J.O. Aho wrote:
>>> On 29/07/13 20:37, Luuk wrote:
>>>
>>>> BTW, why is this message cross-posted to 'comp.datbase.mysql'
>>>
>>> I think Denis thought the question was relevant for c.d.m (maybe it
>>> should have been posted in the inactive group alt.php.sql).
>>>
>>>
>>>> it's a non-existing newsgroup......
>>>
>>> Just for your service provider don't supply that news group, id do
>>> exist.
>>>
>>>
>>
>> My newsgroup provider doesn't carry comp.database.mysql, either.  It
>> does, however, carry comp.databaseS.mysql.
>
> I could try to blame it was still early in the morning for me... just
> didn't check the spelling that closely.
>

Moral of the story - don't reply before drinking at least 3 cups of 
coffee :)

I've been known to do even stupider things before my morning coffee and 
just before bedtime!


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#10304

In article <b5p1d0Fr6rjU1@mid.individual.net>,
J.O. Aho <user@example.net> wrote:
> On 29/07/13 20:37, Luuk wrote:
> 
> > BTW, why is this message cross-posted to 'comp.datbase.mysql'
> 
> I think Denis thought the question was relevant for c.d.m (maybe it 
> should have been posted in the inactive group alt.php.sql).
> 
> 
> > it's a non-existing newsgroup......
> 
> Just for your service provider don't supply that news group, id do exist.

The point was that "datbase" is a misspelling...

Cheers
Tony
-- 
Tony Mountifield
Work: tony@softins.co.uk - http://www.softins.co.uk
Play: tony@mountifield.org - http://tony.mountifield.org

[toc] | [prev] | [next] | [standalone]

#10309

On Mon, 29 Jul 2013 20:37:00 +0200, Luuk wrote:

> BTW, why is this message cross-posted to 'comp.datbase.mysql'
> it's a non-existing newsgroup......

The first message of yours that I replied to had comp.datbase.mysql, I 
corrected it to comp.databases.mysql in my response.

I'm guessing that the brainbox that you responded to initially fucked up 
the original newsgroup list. That's about his competence level.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | comp.lang.php

csiph-web