Re: [PHP] mysql_real_escape_string() question

On Thu, September 28, 2006 10:06 am, tedd wrote:
In one of my snip-its, namely:

http://xn--ovg.com/pdf

I was generating a pdf document after the user filled in a form. I
had been cleaning the user input by using --

$name = mysql_real_escape_string($name);

-- even though I wasn't using MySQL (the code was a cut-paste from
some other code I had).

But you *WERE* using MySQL!

However, everything worked!

But, a couple of days ago it suddenly stopped working. Now, I get the
following error:

Warning: mysql_real_escape_string(): Access denied for user
'nobody'@'localhost' (using password: NO) in ...

One of two things happened.

Some auto-connect script is no longer running, or the 'nobody' user in
MySQL got nuked.

Cuz you used to be connected to MySQL, and it was using MySQL database
information to do the escaping.

When I comment-out the offending statement, it runs. I replaced the
statement, but wonder what happened -- when did using
mysql_real_escape_string() require a password?

mysql_real_escape_string talks back to MySQL to ask it what character
encoding you are using, so it knows how to correctly escape
multi-byte/unicode/funky characters for MySQL usage.

Take out the "_real" bit, and it's doing a "fake" version that ignores
multibyte/unicode/funky characters.

So, short term, just delete '_real' from your function call, and it
will act exactly like before, except with the caveat that any
unicode/multibyte/funky characters may not be escaped the same way as
they were.

What's up with that? Any ideas as to what happened?

One also has to ask WHY you would use MySQL's escaping for data that's
not going into MySQL.

That's almost certainly "wrong"

Though I confess, I'm sometimes at a loss how to properly escape
certain data for certain situations...

Here's an example:
Take the Subject of an email.

Sure, I've sanitized it to be sure there are no newlines for header
injection.

But now how do I properly escape it to be sure it's a kosher email
subject?

Where's the PHP function smtp_escape()?

I'm just passing it on from one user to another. I don't want to
munge it, nor make any assumptions about its format. It's just "data"
to me.

But to SMTP, there are bound to be all kinds of "rules" about it that
I have no desire, much less time, to research, code, and test in as
thorough a fashion as I should to be Professional.

And every developer who sends an email with PHP needs this, right?

So of the myriad PHP functions available, which one is the right one
to escape an email Subject.

I'm *NOT* asking for an answer to this specific question about email
Subjects!

I'm looking for a guide, a chart, a grid, an organized systemic
documentation of what data should be escaped how as it travels through
the "glue" that is PHP...

--
Like Music?
http://l-i-e.com/artists.htm
.

Relevant Pages

  • Re: PHP, mysql, and escaping characters
    ... MySQL requires only that backslash and the quote ... In addition to the qutoes, backslashes, and nulls, real escape string ... "Inserting a large value into a BLOB column is no different than ... a few characters that have special meaning in SQL or to the MySQL ...
    (comp.lang.php)
  • Re: paste as plain text from word
    ... something like PHP does for MySQL with mysql_real_escape_string. ... I do an escape and then urlencode, and the server is internal for us, ... out the internet and without critical data. ... string contains characters that are interpreted as control characters like ...
    (comp.lang.javascript)
  • Re: DBI quote alternative
    ... > MySQL also permits backslash to escape single-quotes. ... > MySQL has a function QUOTEthat does a similar treatment to string you ...
    (comp.lang.perl.modules)
  • Re: Allowing special characters in a MySql Database
    ... I originally thought it was MySQL stripping them out but I did a ... actually removing the characters when i hit the submit button though. ... > php has an escape function specifically for mySQL inserts ...
    (microsoft.public.dotnet.general)
  • Re: mysql_real_escape_string usage
    ... In my haste I may have mixed up mysql storage with sqlite.Sqlite stores the string as escaped and returns it as escaped, Curtis may be right saying mysql dosn't store/return it as an escaped sequence, but i can't test that atm. ... If you use a DB escape function while magic_quotes_gpc is enabled, ...
    (comp.lang.php)