Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #13826

Re: function for preserving special characters?

Show all headers | View raw

In article <539b0a09$0$6621$9b4e6d93@newsspool4.arcor-online.net>,
Christoph Michael Becker <cmbecker69@arcor.de> wrote:

> Tim Streater wrote:
> 
> > In article <539afd73$0$6602$9b4e6d93@newsspool4.arcor-online.net>,
> > Christoph Michael Becker <cmbecker69@arcor.de> wrote:
> > 
> >> Tim Streater wrote:
> >>
> >> > In article <4s7xh8hg1pcy.ov70m21znbte$.dlg@40tude.net>, richard
> >> > <noreply@example.com> wrote:
> >> > >> When attempting to transfer records from one table to another,
> >> certain
> >> >> records refuse to be.
> >> >> Such as those with words like "I'm".
> >> >> What's even more confusing is, "It's" won't work, but "Cathy's" is ok?
> >> >>
> >> >> I know there is a procedure in PHP for dealing with this.
> >> >> I just can't find it right now.
> >> >> Can anyone help on this?
> >> > > You need to read up on your database and find how it deals with
> >> things
> >> > like single-quotes (') in strings that you want to update a column
> >> > with. Or rather, how it expects *you* to present the data.
> >> > > For SQLite, I do this:
> >> > >     $x   = str_replace ('\'', '\'\'', $xx);
> >>
> >> However, remember Bobby Tables: <http://xkcd.com/327/>.
> > 
> > :-)  Yeah yeah.
> > 
> > However in this case the guy doing the hacking would be the guy whose
> > data would be trashed. Why destroy your own data that way when you can
> > just drag the entire file to the Trash and empty it.
> 
> ACK.
> 
> However, my reply was not particularly meant for you, but also for
> others who want to do this on otherwise unsanitized user input.

Still, it was quite useful as I went back and entered variants of:

    xxx'); drop table xyz; --

into some screen entry fields without succeeding in doing any damage.
Either the entry was rejected (by my code) for a numeric field, or was
accepted verbatim and ended up in a database field. Not that this
proves invulnerability, but it's at least a start.

-- 
"The idea that Bill Gates has appeared like a knight in shining armour to
 lead all customers out of a mire of technological chaos neatly ignores 
 the fact that it was he who, by peddling second-rate technology, led them
 into it in the first place."                             - Douglas Adams

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

function for preserving special characters? richard <noreply@example.com> - 2014-06-13 00:57 -0400
  Re: function for preserving special characters? Tim Streater <timstreater@greenbee.net> - 2014-06-13 10:03 +0100
    Re: function for preserving special characters? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-06-13 15:32 +0200
      Re: function for preserving special characters? Tim Streater <timstreater@greenbee.net> - 2014-06-13 14:42 +0100
        Re: function for preserving special characters? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-06-13 16:26 +0200
          Re: function for preserving special characters? Tim Streater <timstreater@greenbee.net> - 2014-06-13 18:23 +0100
  Re: function for preserving special characters? Doug Miller <doug_at_milmac_dot_com@example.com> - 2014-06-13 10:39 +0000
    Re: function for preserving special characters? Paul Herber <paul@pherber.com> - 2014-06-13 12:37 +0100
      Re: function for preserving special characters? Doug Miller <doug_at_milmac_dot_com@example.com> - 2014-06-13 12:59 +0000
      Re: function for preserving special characters? richard <noreply@example.com> - 2014-06-13 14:45 -0400
  solved  (was: function for preserving special characters?) richard <noreply@example.com> - 2014-06-13 09:57 -0400
    Re: solved Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 10:14 -0400
      Re: solved richard <noreply@example.com> - 2014-06-13 14:43 -0400
        Re: solved Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 15:01 -0400
          Re: solved richard <noreply@example.com> - 2014-06-13 15:44 -0400
            Re: solved Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 16:09 -0400
            Re: solved Tim Streater <timstreater@greenbee.net> - 2014-06-13 21:16 +0100
              Re: solved Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 16:38 -0400
                Re: solved richard <noreply@example.com> - 2014-06-13 18:29 -0400
                Re: solved Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 19:43 -0400
                Re: solved richard <noreply@example.com> - 2014-06-13 20:48 -0400
                Re: solved Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 21:39 -0400
                Re: solved Evan Platt <evan@theobvious.espphotography.com.invalid> - 2014-06-13 21:20 -0700
                Re: solved Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-14 19:50 +0000
              Re: solved richard <noreply@example.com> - 2014-06-13 18:23 -0400
                Re: solved Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-14 20:01 +0000
            Re: solved Denis McMahon <denismfmcmahon@gmail.com> - 2014-06-13 20:50 +0000
  Re: function for preserving special characters? Richard Damon <Richard@Damon-Family.org> - 2014-06-13 20:45 -0400
    Re: function for preserving special characters? Jerry Stuckle <jstucklex@attglobal.net> - 2014-06-13 20:51 -0400
      Re: function for preserving special characters? Richard Damon <Richard@Damon-Family.org> - 2014-06-13 22:08 -0400

csiph-web