Re: [PHP] Using mysql_real_escape_string without connecting to mysql

Dotan Cohen schreef:
On 23/01/2008, Jochem Maas <jochem@xxxxxxxxxxxxx> wrote:
I can read, I saw 2 functions the first time. each function cleans *and* escapes.

cleaning is filtering of input.
escaping is preparing for output.

2 concepts.

I see your point.

if the input needs to be stripped of html then it needs that regardless
of the output vector. again removing or not-accepting input if it contains
'--' is a question of filtering/validation ... besides which '--' is quite
acceptable for data stored in a text field but not for a numeric one.

I'm not accepting "--" at all until someone can show me a real world
case where one would use it, without the intention of SQL injection.
How can it be escaped, anyway?

I might just want to put '--' in a textfield used as the basis for content
for a webpage. just because I want to. the most pertinent example are wikis,
they use '--' as markup (which is usually transformed into an <hr /> when the
results are output for viewing ... but obviously you want the original markup
when editing.

INSERT INTO foo (textfield) VALUES ('--');

nothing to escape in the case of a those chars being part of a string, the escaping
mechanism [hopefully] ensures that a given string will never contain a byte sequence that
the query parser will misinterpret as a sign to end the string (before the last intend quote
delimiter) prematurely and thereby treat the remainder of the input string as SQL.


filter each piece of data
validate each piece of data
escape each peice of data for each context in which it will be output.

I see that you have more experience than I!

imho your functions are conceptually wrong and not very robust either -
don't take it as a personal attack - I'm very sure if we sat down with *some*
of my code the same critism could be made to more or lesser extent :-) ...
"getting better all the time" as they sang once ;-)

I never thought that was a personal attack, not for a second. Rather,
I very much appreciate the time you take to explain to me my errors.
And I intend to learn from them. For the time being, I'll leave the
code as it is. However, for future projects, I will make a point of
separating the different functions. Thanks.

Dotan Cohen

http://what-is-what.com
http://gibberish.co.il
א-ב-ג-ד-ה-ו-ז-ח-ט-י-ך-כ-ל-ם-מ-ן-נ-ס-ע-ף-פ-ץ-צ-ק-ר-ש-ת

A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
.

Relevant Pages

  • xml escapedness
    ... A colleague has decided to keep his django database string values in an xml escaped form to avoid having the problem of escaping them when they are used in templates etc etc. ... Unfortunately he found that the normal admin doesn't escape on the way through so thought of adding a standard mechanism to the save methods. ...
    (comp.lang.python)
  • Re: Error when substituting a backslash in a string
    ... Because you're essentially escaping a single quote in your String#sub ... Double escape that too: ... Suppose I wanted to make a string with single quotes in ...
    (comp.lang.ruby)
  • Re: Unrecognized escape sequences in string literals
    ... If you don't know what your string literals are, ... Adding escape codes into the string literal doesn't change this ... extra effort required to defeat the compiler (forcing the programmer to ... And if you saw that in Python, you'd also know that there are some ...
    (comp.lang.python)
  • Re: Unrecognized escape sequences in string literals
    ... need worry that I've misinterpreted what a string literal means. ... You can't expect the compiler to save you from ... Adding escape codes into the string literal doesn't ... (This behavior is useful when debugging: if an escape sequence is ...
    (comp.lang.python)
  • Re: problems with opening files due to files path
    ... GUI or it is a console app. ... of what an escape character and escape sequence is. ... character) inside a string specially, it makes the character after the ...
    (comp.lang.python)