Addslashes / Stripslashes

[Areric]

hey all,

I recently got in a bit of a fight with my webhost because he made some
changes to my server. Specifically they updated php without telling me.
They are now running PHP 4.4.1 (not sure what it was before).

Anyway i mention that cause i had a script that uploaded the content of
an image to a DB, then displayed it straight from the DB using gdlib.
Before i store the content of the image i did an addslashes() and
before i displayed it i did a stripslashes().

Now my opinion of those functions is that they are designed to prevent
injection attacks by deliminting commonly used sql escapes. Seeing as
how its not too hard to write a sql script and save it as a .jpg i
wanted to make sure i prevented this.

Well im still doing both functions but it doesnt seem to be working
anymore since the upgrade. Specifically the number of bytes passed into
the addslashes() doesnt match the number of bytes returned from the
stripslashes(). The variable after the strip is signifigantly smaller.

Does anyone know what could be causing this, and if there is some sort
of defect with this version of PHP?

My impression is that its stripping out slashes it doesnt need to be,
and seeing as how the binary content of an image file is pretty strange
its possible slashes could be in there as valid characters.

[Erwin Moller]

Re: Addslashes / Stripslashes

Areric wrote:
[color=blue]
> hey all,
>
> I recently got in a bit of a fight with my webhost because he made some
> changes to my server. Specifically they updated php without telling me.
> They are now running PHP 4.4.1 (not sure what it was before).
>
> Anyway i mention that cause i had a script that uploaded the content of
> an image to a DB, then displayed it straight from the DB using gdlib.
> Before i store the content of the image i did an addslashes() and
> before i displayed it i did a stripslashes().
>
> Now my opinion of those functions is that they are designed to prevent
> injection attacks by deliminting commonly used sql escapes. Seeing as
> how its not too hard to write a sql script and save it as a .jpg i
> wanted to make sure i prevented this.[/color]

Chances are that the hostingcompany changed php.ini too.
Just check for magic_quotes, you can also access the value using
getmagicquotesg pc() or something named similar to that.

If you don't like the changes, just modify your script so it does handle the
different settings in php.ini always right.

[color=blue]
>
> Well im still doing both functions but it doesnt seem to be working
> anymore since the upgrade. Specifically the number of bytes passed into
> the addslashes() doesnt match the number of bytes returned from the
> stripslashes(). The variable after the strip is signifigantly smaller.[/color]

probably the removed slashes...
[color=blue]
>
> Does anyone know what could be causing this, and if there is some sort
> of defect with this version of PHP?[/color]

No, just read the manual on magic_quotes.

https://www.php.net

[color=blue]
>
> My impression is that its stripping out slashes it doesnt need to be,
> and seeing as how the binary content of an image file is pretty strange
> its possible slashes could be in there as valid characters.[/color]

I have no idea, I never study binary representations of images.

Regards,
Erwin MOller

[Jerry Stuckle]

Re: Addslashes / Stripslashes

Areric wrote:[color=blue]
> hey all,
>
> I recently got in a bit of a fight with my webhost because he made some
> changes to my server. Specifically they updated php without telling me.
> They are now running PHP 4.4.1 (not sure what it was before).
>
> Anyway i mention that cause i had a script that uploaded the content of
> an image to a DB, then displayed it straight from the DB using gdlib.
> Before i store the content of the image i did an addslashes() and
> before i displayed it i did a stripslashes().
>
> Now my opinion of those functions is that they are designed to prevent
> injection attacks by deliminting commonly used sql escapes. Seeing as
> how its not too hard to write a sql script and save it as a .jpg i
> wanted to make sure i prevented this.
>
> Well im still doing both functions but it doesnt seem to be working
> anymore since the upgrade. Specifically the number of bytes passed into
> the addslashes() doesnt match the number of bytes returned from the
> stripslashes(). The variable after the strip is signifigantly smaller.
>
> Does anyone know what could be causing this, and if there is some sort
> of defect with this version of PHP?
>
> My impression is that its stripping out slashes it doesnt need to be,
> and seeing as how the binary content of an image file is pretty strange
> its possible slashes could be in there as valid characters.
>[/color]

You shouldn't be using addslashes before putting it to the database. You should
use mysql_escape_st ring() (or, for later versions of MySQL, the more preferable
mysql_real_esca pe_string() ) instead.

Then you don't need to call stripslashes() afterwards.

And the change may be that they set magic_quotes_gp c to off, either by a change
in the default or by changing the php.ini file.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Areric]

Re: Addslashes / Stripslashes

Thanks guys. If anything your giving me options to prove it was a
config change and that im not completley crazy (although i suppose that
has yet to be proven).

As for mysql_escape_st ring is that a mysql function or php. hmm i
suppose i could look it up, nm.

Ill check in to that.

[Jerry Stuckle]

Re: Addslashes / Stripslashes

Areric wrote:[color=blue]
> Thanks guys. If anything your giving me options to prove it was a
> config change and that im not completley crazy (although i suppose that
> has yet to be proven).
>
> As for mysql_escape_st ring is that a mysql function or php. hmm i
> suppose i could look it up, nm.
>
> Ill check in to that.
>[/color]

Areric,

It's a MySQL function to format strings to be able to place them into a MySQL
database. If you're running a fairly recent release of MySQL (I don't remember
exactly when it became available), mysql_real_esca pe_string() is preferable
because it takes into account the current character set being used by MySQL.

When working with a database, it's almost always better to use database
functions such as this vs. generic PHP functions.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===