mysql-real-escape-string

Adding mysql_real_escape_string() causes blank values to be stored to database

由 女生的网名这么多〃 提交于 2019-12-10 10:29:37
问题 $submit=$_POST['submit']; $fullname=$_POST['fullname']; $phone=preg_replace('/[^0-9]/', '', $_POST['phone']); $phone = (int) $phone; $adress=$_POST['city'] . ' ' . $_POST['district'] . ' ' . $_POST['adress']; $friends=$_POST['friends']; $school=$_POST['school']; $info=$_POST['info']; $dob = $_POST['year']."-". $_POST['month']."-".$_POST['day']; Recently i added to my page: foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); } i want to sanitize all $_POST's

PHP: using prepared statements and protecting against SQL injection vs escape

由 自古美人都是妖i 提交于 2019-12-10 04:30:14
问题 I do understand that the prepared statements is the ultimate way to seek protection against the SQL injection. However, they provide coverage in a limited fashion; for example, in cases where I let the user to decide how the order by operation to be ( i.e, is it ASC or DESC? etc ), I get no coverage there with the prepared statements. I understand that I can map the user input to a pre-defined white list for that. But, this is only possible when a whitelist can be created or guessed

mysql_real_escape_string not good enough?

由 核能气质少年 提交于 2019-12-08 06:37:47
问题 So using %27 you can just SQL inject even though data is sanitized with mysql_real_escape_string %27) SQL INJECTION HERE %2F* What to do? Edit with example: $sql = sprintf("SELECT *, MATCH(post) AGAINST ('%s*' IN BOOLEAN MODE) AS score FROM Posts WHERE MATCH(post) AGAINST('%s*' IN BOOLEAN MODE)", mysql_real_escape_string($_GET['searchterm']), mysql_real_escape_string($_GET['searchterm'])); $results = $db->queryAsArray($sql); If you pass in %27) SQL INJECTION HERE %2F* to the searchterm

filter_input and mysqli_real_escape_string for integers

由 断了今生、忘了曾经 提交于 2019-12-08 03:56:43
问题 I'm developing a simple PHP database application for internal use but would like to code it to best practices. Some of my pages are receiving integer values from GET requests and I'm just wondering how much validation and sanitation is really required. Currently I'm using $num = filter_input(INPUT_GET, 'num', FILTER_VALIDATE_INT, $num_options); with specified min and max values. From here I'm exiting with an error message if $num == false Is it necessary to also use $mysqli->real_escape

PHP MYSQL file contents escape problem

由 喜欢而已 提交于 2019-12-07 19:44:39
问题 I am attempting to upload a .pdf file into a mysql database using php. It is all good except for the contents of the file. No matter how I seem try to escape special characters, the query always fails, mostly with "Unknown Command \n". I have used addslashes, mysql_real_escape_string, removeslashes etc. Does anyone have any ideas on how to escape file contents? Many Thanks, 回答1: I've used the following sequence before, which seems to work nicely, and will store any data into the db, including

filter_input and mysqli_real_escape_string for integers

由 旧城冷巷雨未停 提交于 2019-12-06 15:05:34
I'm developing a simple PHP database application for internal use but would like to code it to best practices. Some of my pages are receiving integer values from GET requests and I'm just wondering how much validation and sanitation is really required. Currently I'm using $num = filter_input(INPUT_GET, 'num', FILTER_VALIDATE_INT, $num_options); with specified min and max values. From here I'm exiting with an error message if $num == false Is it necessary to also use $mysqli->real_escape_string($num); Currently I am not bothering because I think it's quite hard to do SQL injection using an

Can't use mysql_real_escape_string

由 早过忘川 提交于 2019-12-06 15:02:50
问题 So, I'm getting this warning when using mysql_real_escape_string Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'username'@'localhost' (using password: NO) in /home/path/php/functions.php on line 11 The rest of the site works fine, connects to the DB and all, but I get an error when using this function. It works completely fine on my localhost testing server. Any ideas? I use aforementioned function in my own homebrew string sanitation function

PHP MYSQL file contents escape problem

由 笑着哭i 提交于 2019-12-06 11:13:27
I am attempting to upload a .pdf file into a mysql database using php. It is all good except for the contents of the file. No matter how I seem try to escape special characters, the query always fails, mostly with "Unknown Command \n". I have used addslashes, mysql_real_escape_string, removeslashes etc. Does anyone have any ideas on how to escape file contents? Many Thanks, I've used the following sequence before, which seems to work nicely, and will store any data into the db, including images, pdfs, arrays of data, etc... :) Storing the data (can be a string, array, object, etc.); First,

Adding mysql_real_escape_string() causes blank values to be stored to database

由 …衆ロ難τιáo~ 提交于 2019-12-06 06:27:41
$submit=$_POST['submit']; $fullname=$_POST['fullname']; $phone=preg_replace('/[^0-9]/', '', $_POST['phone']); $phone = (int) $phone; $adress=$_POST['city'] . ' ' . $_POST['district'] . ' ' . $_POST['adress']; $friends=$_POST['friends']; $school=$_POST['school']; $info=$_POST['info']; $dob = $_POST['year']."-". $_POST['month']."-".$_POST['day']; Recently i added to my page: foreach ($_POST as $key => $value) { $_POST[$key] = mysql_real_escape_string($value); } i want to sanitize all $_POST's ( http://prntscr.com/22uot ) ID 20 before adding mysql_real_escape_string() to my page, id 22 after. My

mysql_real_escape_string() for $_SESSION variables necessary?

由 与世无争的帅哥 提交于 2019-12-06 02:22:21
问题 Should I use the mysql_real_escape_string() function in my MySQL queries for $_SESSION variables? Theoretically, the $_SESSION variables can't be modified by the end-user unlike $_GET or $_POST variables right? Thanks :) 回答1: Regardless of whether the user can modify the data, you probably want to escape it anyway in case you ever need the data to contain characters that would break the SQL (quotes, etc). Better yet, use bound parameters and you won't have to worry about it. 回答2: Do not
订阅 mysql-real-escape-string