FUDforum: comp.lang.php » is mysqli_real_escape_string bullet proof with binary data?

Home » Imported messages » comp.lang.php » is mysqli_real_escape_string bullet proof with binary data?

Show: Today's Messages :: Polls :: Message Navigator

Re: is mysqli_real_escape_string bullet proof with binary data? [message #182331 is a reply to message #182327]

Sun, 28 July 2013 16:39

The Natural Philosoph
Messages: 993
Registered: September 2010

Karma:

Senior Member

On 28/07/13 16:44, Luuk wrote:
>
> I was not trying to contradict anything. I was reading the post (from
> Pierre) and was under the impression that i SHOULD use 'b' in bind_param.
>
> I was using 's' in bind_param, and my testprog works ok
>
> These 2 lines made /me confused ;)
>
>> I'd really like to know why..
>>
>
> Me likes to know why to
>
Ok. Lets take a step back and summarise - and feel free to correct me if
I am wrong.

1/. Mysql can store anything in a BLOB.
2/. Using prepared statements binary data in a 'string' variable will
be stored correctly via the PHP API.
3/. What about un-prepared statements like:

(getting data out is not a major issue)

$blob=file_get_contents('mygraffix.png')

mysqli_query($link, sprintf("insert into mytable set myblob='%s'",$blob));

Presumably that will barf at some point because the PHP itself will get
confused about where the string begins and ends?

Or does it? I suppose its down to the way PHP parses the query string
and sends it.

Which is why the 'prepared' statement or 'Load_file()' options are
preferred?

i.e. the problem is not with mysql per se, but with PHPs way of handling
strings..

In C of course you simply use mysql_real_query() and specify the query
length..

But I can't actually see how even that will work.. OK you now how long
the total statement has to be, but
at some level you are going to have a statement like 'update mytable,
set bmyblob=randombinarydatapossibly_containing,set
something_else=somethingelse'

That is, simply knowing the completed query LENGTH does not remove
ambiguity.

Where this leaves me is essentially that methods (1) and (2) above are
the only reliable ways to do this job.

I'd like that confirmed or denied..

In the past I have always used load_file with no real issues, but in the
new application security is of major concern. I don't want the average
uploader of images to have general FILE access.

--
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to lead are elected by the least capable of producing, and where the members of society least likely to sustain themselves or succeed, are rewarded with goods and services paid for by the confiscated wealth of a diminishing number of producers.

Report message to a moderator

[Message index]

		is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sat, 27 July 2013 09:31
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sat, 27 July 2013 09:45
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sat, 27 July 2013 11:08
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sat, 27 July 2013 13:28
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sat, 27 July 2013 14:36
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sat, 27 July 2013 15:22
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sat, 27 July 2013 15:34
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 23:44
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sun, 28 July 2013 12:54
		Re: is mysqli_real_escape_string bullet proof with binary data? By: J.O. Aho on Sun, 28 July 2013 13:35
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sun, 28 July 2013 13:39
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sun, 28 July 2013 15:25
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sun, 28 July 2013 19:05
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sun, 28 July 2013 19:16
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Mon, 29 July 2013 00:46
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Daniel Pitts on Mon, 29 July 2013 16:17
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Mon, 29 July 2013 18:01
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Mon, 29 July 2013 23:04
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Tue, 30 July 2013 01:02
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Mon, 29 July 2013 18:34
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 13:52
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sat, 27 July 2013 13:58
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 14:36
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 14:43
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Pierre Jaury on Sat, 27 July 2013 18:10
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 23:52
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Denis McMahon on Sat, 27 July 2013 18:38
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Pierre Jaury on Sat, 27 July 2013 20:25
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sat, 27 July 2013 20:59
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sat, 27 July 2013 23:50
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sun, 28 July 2013 15:44
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Pierre Jaury on Sun, 28 July 2013 16:01
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sun, 28 July 2013 16:43
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Sun, 28 July 2013 18:31
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sun, 28 July 2013 16:39
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Pierre Jaury on Sun, 28 July 2013 17:56
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sun, 28 July 2013 18:14
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sun, 28 July 2013 19:10
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Norman Peelman on Mon, 29 July 2013 01:13
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sat, 27 July 2013 23:46
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 23:56
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Pierre Jaury on Sun, 28 July 2013 01:55
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sun, 28 July 2013 02:11
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 23:58
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Norman Peelman on Sat, 27 July 2013 13:35
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 13:56
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Norman Peelman on Sun, 28 July 2013 00:01
		Re: is mysqli_real_escape_string bullet proof with binary data? By: The Natural Philosoph on Sat, 27 July 2013 14:33
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Sat, 27 July 2013 13:57
		I've always used GD, but never been 100% happy with it (Was: is mysqli_real_escape_string bullet proof with binary data?) By: J.O. Aho on Sat, 27 July 2013 16:09
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Luuk on Mon, 29 July 2013 18:37
		Re: is mysqli_real_escape_string bullet proof with binary data? By: J.O. Aho on Tue, 30 July 2013 05:31
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Tue, 30 July 2013 06:08
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Scott Johnson on Tue, 30 July 2013 12:35
		Re: is mysqli_real_escape_string bullet proof with binary data? By: J.O. Aho on Tue, 30 July 2013 15:53
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Jerry Stuckle on Tue, 30 July 2013 16:37
		Re: is mysqli_real_escape_string bullet proof with binary data? By: tony on Tue, 30 July 2013 09:35
		Re: is mysqli_real_escape_string bullet proof with binary data? By: Denis McMahon on Wed, 31 July 2013 04:56

Previous Topic:	Major trouble with PhpDocumentor
Next Topic:	Education Path to become a PHP developer using free online courses

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Sun Nov 10 05:38:56 GMT 2024

Total time taken to generate the page: 0.03976 seconds