Preventing DB crahses with inserts.

[Sims]

Hi,

Is there a function to insert a string safely in the DB?
To ensure that nothing the user can pass will cause an errors or unwanted
behaviour/hacking?

The html function(s) only ensure that there are not special characters.
Would replacing the words WHERE/SELECT/UPDATE/DELETE with some special words
like {W}HERE/{S}ELECT etc be safer?

Many thanks

Sims

[Kevin Thorpe]

Re: Preventing DB crahses with inserts.

Sims wrote:
[color=blue]
> Hi,
>
> Is there a function to insert a string safely in the DB?
> To ensure that nothing the user can pass will cause an errors or unwanted
> behaviour/hacking?
>
> The html function(s) only ensure that there are not special characters.
> Would replacing the words WHERE/SELECT/UPDATE/DELETE with some special words
> like {W}HERE/{S}ELECT etc be safer?[/color]

mysql_escape_st ring($rawstring )

[Sims]

Re: Preventing DB crahses with inserts.

> >[color=blue][color=green]
> > The html function(s) only ensure that there are not special characters.
> > Would replacing the words WHERE/SELECT/UPDATE/DELETE with some special[/color][/color]
words[color=blue][color=green]
> > like {W}HERE/{S}ELECT etc be safer?[/color]
>
> mysql_escape_st ring($rawstring )[/color]

But will that guarantee that the query can never be hacked?
Is that the common way of solving the problem?

Sims

[Matthias Esken]

Re: Preventing DB crahses with inserts.

"Sims" <siminfrance@ho tmail.com> schrieb:
[color=blue][color=green]
>> mysql_escape_st ring($rawstring )[/color]
>
> But will that guarantee that the query can never be hacked?
> Is that the common way of solving the problem?[/color]

If you use MySQL: Yes.

Regards,
Matthias

[Jochen Daum]

Re: Preventing DB crahses with inserts.

Hi !

On Wed, 25 Feb 2004 20:36:40 +0200, "Sims" <siminfrance@ho tmail.com>
wrote:
[color=blue][color=green][color=darkred]
>> >
>> > The html function(s) only ensure that there are not special characters.
>> > Would replacing the words WHERE/SELECT/UPDATE/DELETE with some special[/color][/color]
>words[color=green][color=darkred]
>> > like {W}HERE/{S}ELECT etc be safer?[/color]
>>
>> mysql_escape_st ring($rawstring )[/color]
>
>But will that guarantee that the query can never be hacked?
>Is that the common way of solving the problem?[/color]

You have to apply it to each value that you insert. That ensures that
noone can close the single quotes early and run an extra command.

Yes, it is common

Jochen
--
Jochen Daum - Cabletalk Group Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.

http://sourceforge.net/projects/phpdbedittk/

[Sims]

Re: Preventing DB crahses with inserts.

[color=blue][color=green][color=darkred]
> >> mysql_escape_st ring($rawstring )[/color]
> >
> > But will that guarantee that the query can never be hacked?
> > Is that the common way of solving the problem?[/color]
>
> If you use MySQL: Yes.
>[/color]

What do you mean? it is called 'MYSQL_escape_s tring(...)' so you must be
using MySQL.
Or are you saying that adding an escape string is only safe with MySQL.

Sims

[Sims]

Re: Preventing DB crahses with inserts.

> You have to apply it to each value that you insert. That ensures that[color=blue]
> noone can close the single quotes early and run an extra command.[/color]

Should i apply the same rule to Numbers? Or should I convert the string to
numbers b4 i add it to the querry?

So if i have a table like

TABLE_TEST
A = TEXT
B = INT(11)

should i do...

UPDATE TABLE_TEST SET A = '".mysql_escape _string($givenA )."',
B='".mysql_esca pe_string($give nB)."'";

or

UPDATE TABLE_TEST SET A = '".mysql_escape _string($givenA )."',
B='".intval($gi venB)."'";
[color=blue]
>
> Yes, it is common[/color]

Thanks.

Regards,

Sims

[Matthias Esken]

Re: Preventing DB crahses with inserts.

"Sims" <siminfrance@ho tmail.com> schrieb:
[color=blue][color=green][color=darkred]
>>>> mysql_escape_st ring($rawstring )
>>>
>>> But will that guarantee that the query can never be hacked?
>>> Is that the common way of solving the problem?[/color]
>>
>> If you use MySQL: Yes.[/color]
>
> What do you mean? it is called 'MYSQL_escape_s tring(...)' so you must be
> using MySQL.[/color]

Yes.
[color=blue]
> Or are you saying that adding an escape string is only safe with MySQL.[/color]

I think it should be safe with other databases, but I don't know every
existing RDBMS around, so I don't know if this will work everywhere.

Regards,
Matthias

[Jochen Daum]

Re: Preventing DB crahses with inserts.

Hi!

On Thu, 26 Feb 2004 10:59:19 +0200, "Sims" <siminfrance@ho tmail.com>
wrote:
[color=blue][color=green]
>> You have to apply it to each value that you insert. That ensures that
>> noone can close the single quotes early and run an extra command.[/color]
>
>Should i apply the same rule to Numbers? Or should I convert the string to
>numbers b4 i add it to the querry?
>
>So if i have a table like
>
>TABLE_TEST
>A = TEXT
>B = INT(11)
>
>should i do...
>
>UPDATE TABLE_TEST SET A = '".mysql_escape _string($givenA )."',
>B='".mysql_esc ape_string($giv enB)."'";
>
>or
>
>UPDATE TABLE_TEST SET A = '".mysql_escape _string($givenA )."',
>B='".intval($g ivenB)."'";[/color]

I prefer latter. Its also closer to the SQL standard I believe.

HTH, Jochen
--
Jochen Daum - Cabletalk Group Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.

http://sourceforge.net/projects/phpdbedittk/

[Jochen Daum]

Re: Preventing DB crahses with inserts.

Hi!

On Thu, 26 Feb 2004 18:07:40 +0100, Matthias Esken
<muelleimer2004 nospam@usenetve rwaltung.org> wrote:
[color=blue]
>"Sims" <siminfrance@ho tmail.com> schrieb:
>[color=green][color=darkred]
>>>>> mysql_escape_st ring($rawstring )
>>>>
>>>> But will that guarantee that the query can never be hacked?
>>>> Is that the common way of solving the problem?
>>>
>>> If you use MySQL: Yes.[/color]
>>
>> What do you mean? it is called 'MYSQL_escape_s tring(...)' so you must be
>> using MySQL.[/color]
>
>Yes.
>[color=green]
>> Or are you saying that adding an escape string is only safe with MySQL.[/color]
>
>I think it should be safe with other databases, but I don't know every
>existing RDBMS around, so I don't know if this will work everywhere.[/color]

Informix and MSSQL uses '' to esacpe a single quote. So it is neither
safe, nor correct there.

HTH, Jochen

[color=blue]
>
>Regards,
> Matthias[/color]

--
Jochen Daum - Cabletalk Group Ltd.
PHP DB Edit Toolkit -- PHP scripts for building
database editing interfaces.

http://sourceforge.net/projects/phpdbedittk/

[Andy Hassall]

Re: Preventing DB crahses with inserts.

On Thu, 26 Feb 2004 18:07:40 +0100, Matthias Esken
<muelleimer2004 nospam@usenetve rwaltung.org> wrote:
[color=blue][color=green][color=darkred]
>>>>> mysql_escape_st ring($rawstring )
>>>>
>>>> But will that guarantee that the query can never be hacked?
>>>> Is that the common way of solving the problem?
>>>
>>> If you use MySQL: Yes.[/color]
>>
>> What do you mean? it is called 'MYSQL_escape_s tring(...)' so you must be
>> using MySQL.[/color]
>
>Yes.
>[color=green]
>> Or are you saying that adding an escape string is only safe with MySQL.[/color]
>
>I think it should be safe with other databases, but I don't know every
>existing RDBMS around, so I don't know if this will work everywhere.[/color]

Sensible databases support bind variables/placeholders, separating data from
the SQL, and so avoiding the issue entirely.

--
Andy Hassall <andy@andyh.co. uk> / Space: disk usage analysis tool
<http://www.andyh.co.uk > / <http://www.andyhsoftwa re.co.uk/space>