Re: Sanitizing potential MySQL strings with no database connection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dotan Cohen wrote:
> 2009/10/19 Kim Madsen <php.net@xxxxxxx>:
>> Dotan Cohen wrote on 2009-10-18 21:21:
>>
>>> I thought that one could not test if a database connection is
>>> established or not, this is the most relevant thing that I found while
>>> googling that:
>>> http://bugs.php.net/bug.php?id=29645
>> from http://www.php.net/manual/en/function.mysql-connect.php
>>
>> $link = mysql_connect('localhost', 'mysql_user', 'mysql_password');
>> if (!$link) {
>>    die('Could not connect: ' . mysql_error());
>> }
>>
>> So just test if $link is available
>>
> 
> I need to know if there is _any_ connection available, not a specific
> connection. In one script it may be $link but in another $connection.
> 

Dotan,

You are making this thing harder then it has to be.

All you need is to replicate the escaping of the same characters that
mysql_real_escape_string() escapes.  Simply do that.  They are listed on the
functions manual page on php.net

http://php.net/mysql_real_escape_string

Here is a function that I mocked up really quick.

I have no idea if it will work, but it is a start down the right road to solve
your problem(s)...

<?php

function clean_string($input) {

  /**
   * Character to escape...
   *	\x0	\n	\r	\	'	"	\x1a
  **/

  $patterns = array( "\x0",   "\n", "\r", "\\",   "'",    "\"", "\x1a");
  $replace = array(  '\\\x0', '\n', '\r', '\\\\', '\\\'', '\\"',  '\\\x1a');
  return str_replace($patterns, $replace, $input);
}

?>

Jim Lucas

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux