Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6286

Re: PHP mysql_excape but need to search for those items

Show all headers | View raw

Jerry Stuckle wrote:
> On 6/11/2012 1:01 PM, mrgushi wrote:
>> Jerry,
>> This is what I'm working with so far.
>>
>> not sure if I've escaped everything I needed too.
>>
>> $ENG = mysql_real_escape_string($ENG);
>> $result = mysql_query("SELECT * FROM br_test WHERE ENG LIKE '$ENG' ");
>> $row = mysql_fetch_array( $result );
>>
>> The $ENG is the input from the search form..
>> The JS problem is valid but then again it will be in a locked down iOS
>> app using PhoneGAp. An I'll be using a HTTPs tunnel to the PHP
>> scripts.. use some sort of cookie with a SSL flag to lock it down. So
>> someone could JailBreak an iOS app and dig down in my settings and
>> figure out the JS but I don't think that likely but ur right I want to
>> take every precaution.
>>
> Yes, that will work very nicely (although it's not considered good form to use
> SELECT * - rather select the individual columns. It will save you heartache
> later).
>
> There are more ways than just jailbreaking the IPhone. There is no guarantee
> that the request even came from your app on an IPhone. The request can easily
> be faked in any number of ways. And there's no guaranteed way to "lock it
> down" and be sure, unless you don't make it ever available via the internet.
>

Don't forget man in the middle, using https will not protect against that.

-- 

   //Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 08:34 -0700
  Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-11 17:54 +0200
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 09:48 -0700
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:26 +0200
  Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 12:38 -0400
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 10:01 -0700
      Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 13:54 -0400
        Re: PHP mysql_excape but need to search for those items "J.O. Aho" <user@example.net> - 2012-06-11 20:38 +0200
          Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 17:06 -0400
            Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:35 +0200
              Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-12 08:00 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-14 08:47 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:40 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 21:07 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-16 08:33 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-16 09:25 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 09:39 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 08:48 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:30 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 13:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:49 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:10 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 20:21 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:11 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 21:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 17:22 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 15:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 10:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 17:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 12:35 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 18:39 +0200
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:32 +0200
  Re: PHP mysql_excape but need to search for those items "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-12 09:38 +0200

csiph-web