Re: Sanitizing potential MySQL strings with no database connection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Jim Lucas wrote:
> Dotan Cohen wrote:
>> 2009/10/19 Kim Madsen <php.net@xxxxxxx>:
>>> Dotan Cohen wrote on 2009-10-18 21:21:
>>>
>>>> I thought that one could not test if a database connection is
>>>> established or not, this is the most relevant thing that I found while
>>>> googling that:
>>>> http://bugs.php.net/bug.php?id=29645
>>> from http://www.php.net/manual/en/function.mysql-connect.php
>>>
>>> $link = mysql_connect('localhost', 'mysql_user', 'mysql_password');
>>> if (!$link) {
>>>    die('Could not connect: ' . mysql_error());
>>> }
>>>
>>> So just test if $link is available
>>>
>> I need to know if there is _any_ connection available, not a specific
>> connection. In one script it may be $link but in another $connection.
>>
> 
> Dotan,
> 
> You are making this thing harder then it has to be.
> 
> All you need is to replicate the escaping of the same characters that
> mysql_real_escape_string() escapes.  Simply do that.  They are listed on the
> functions manual page on php.net
> 
> http://php.net/mysql_real_escape_string
> 
> Here is a function that I mocked up really quick.
> 
> I have no idea if it will work, but it is a start down the right road to solve
> your problem(s)...
> 
> <?php
> 
> function clean_string($input) {
> 
>   /**
>    * Character to escape...
>    *	\x0	\n	\r	\	'	"	\x1a
>   **/
> 
>   $patterns = array( "\x0",   "\n", "\r", "\\",   "'",    "\"", "\x1a");
>   $replace = array(  '\\\x0', '\n', '\r', '\\\\', '\\\'', '\\"',  '\\\x1a');
>   return str_replace($patterns, $replace, $input);
> }
> 
> ?>
> 
> Jim Lucas
> 

So, actually taking a minute to read up on addcslashes(), it is a rather handy
little function.

Taking the list of characters that mysql_real_escape_string() says it escapes:

http://us3.php.net/mysql_real_escape_string

Which it lists: \x00, \n, \r, \, ', " and \x1a

\0  = \x0
\10 = \n
\13 = \r
\92 = \
\44 = '
\34 = "
\26 = \x1a

You could do something like this.

function cleaner($input) {
	return addcslashes($input, "\0\10\13\92\44\34\26");
}

Maybe this will help...

Jim

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux