Re: MySql Injection advice

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



you can do that with IPs because it is an implementation of an integer.

look:
I take a integer value: 2130706433
express it as binary: 1111111000000000000000000000001
now I have to look it as bytes: 11111110  00000000  00000000  00000001
express the bytes as decimals: 127 0 0 1

does this number means anything to you?
IPv4 are just simples integer values stored as bytes

Here you have another example
192.168.0.1
192 = 11000000
168 = 10101000
0 =     00000000
1 = 00000001

all together is 11000000101010000000000000000001
which my calc says it is 3232235521 (it doesn't understand the
negative implementation of numbers)

Telephone numbers are quite different, but in sort way they similars
8765-4321 can be the same as +0871187654321 (if you are in the same are code)

I think the solution should be based in your audience target.

On Tue, Jul 14, 2009 at 4:43 AM, Ashley
Sheridan<ash@xxxxxxxxxxxxxxxxxxxx> wrote:
> On Tue, 2009-07-14 at 01:52 -0400, Andrew Ballard wrote:
>> On Mon, Jul 13, 2009 at 4:18 PM, Haig Dedeyan<hdedeyan@xxxxxxxxxxxx> wrote:
>> > for the phone #'s, I'm using int as the data type & storing each part of the
>> > phone # in its own cell,
>> >
>> > When it gets displayed, I add a dash in between each part of the phone #'s
>> > (country code-area code-1st set of digits-last set of digits)
>> >
>> > Cheers
>> >
>> > Haig
>>
>> I disagree. Telephone numbers are not actually numbers; they are
>> sequences of numeric digits. Unlike IP addresses where 10.0.0.1 is
>> equivalent to 010.000.000.001, leading zeros are significant; they are
>> part of the data, not just padding to be inserted automatically by the
>> database or by a formatting function in the presentation layer. When
>> you validate an area code in the North American numbering plan, do you
>> validate that it is a number between 1 and 999 or do you validate that
>> it is a string of exactly 3 decimal-digit characters long? Expand that
>> to international phone numbers, and the zeros become even more
>> significant since you can't easily make assumptions about the length
>> of various segments in a phone number.
>>
>> Sorry, but I just don't see any advantage to storing them as integers.
>>
>> Andrew
>
> Yeah, that makes sense. Last time I tried to store a phone number as a
> number was at school, when I realised that none of the leading zeros
> were preserved. On UK phone numbers, there's always a leading zero
> unless you're calling directory enquiries or emergency services!
>
> Also, IP addresses can be converted to IP numbers with the long2ip()
> function of PHP, which means you can store them as long ints and do
> normal number comparisons on them, great for matching an IP address to a
> range of 'valid' ones.
>
> Thanks
> Ash
> www.ashleysheridan.co.uk
>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>



-- 
Martin Scotta

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux