_GET['name'] truncates

[Ramon]

Hi all,

I've written a php script, called test.php, consisting of the following
statements:

<?php
error_reporting (E_ALL);
$query = $_GET['sql'];
echo $query;
?>
Using the script with 'small' values for the parameter sql works fine.
Although, using the script with the sql query as specified below

http://localhost/test.php?sql="S ELECT orders_id, customers_id,
customers_name, customers_compa ny, customers_stree t_address,
customers_subur b, customers_city, customers_postc ode, customers_state ,
customers_count ry, customers_telep hone, customers_email _address,
customers_addre ss_format_id, delivery_name, delivery_compan y,
delivery_street _address, delivery_suburb , delivery_city, delivery_postco de,
delivery_state, delivery_countr y, delivery_addres s_format_id, billing_name,
billing_company , billing_street_ address, billing_suburb, billing_city,
billing_postcod e, billing_state, billing_country , billing_address _format_id,
payment_method, cc_type, cc_owner, cc_number, cc_expires, last_modified,
date_purchased, orders_status, orders_date_fin ished, currency,
currency_value FROM orders where ((date_purchase d >= 18991230 and
last_modified is null) or last_modified >= 18991230 ) and orders_status in
(1,2,3) and ((date_purchase d <= 20071201203454 and last_modified is null) or
last_modified <= 20071201203454 ) and orders_id = 2 order by
date_purchased"

results in the following:

\"SELECT orders_id, customers_id, customers_name, customers_compa ny,
customers_stree t_address, customers_subur b, customers_city,
customers_postc ode, customers_state , customers_count ry, customers_telep hone,
customers_email _address, customers_addre ss_format_id, delivery_name,
delivery_compan y, delivery_street _address, delivery_suburb , delivery_city,
delivery_postco de, delivery_state, delivery_countr y,
delivery_addres s_format_id, billing_name, billing_company ,
billing_street_ address, billing_suburb, billing_city, billing_postcod e,
billing_state, billing_country , billing_address _format_id, payment_method,
cc_type, cc_owner, cc_number, cc_expires, last_modified, date_purchased,
orders_status, orders_date_fin ished, currency, currency_value FROM orders
where ((date_purchase d >= 18991230 and last_modified is null) or
last_modified >= 18991230 ) and orders_status in (1,2,3) and%2ÃnÃ

I do not understand why the value of the sql parameter is truncated. Any
help is appreciated!!

Thanks in advance!

[Rik]

Re: _GET['name'] truncates

Ramon <info@kwekerijs chiffelers.nlwr ote:

Hi all,
>
I've written a php script, called test.php, consisting of the following
statements:
>
<?php
error_reporting (E_ALL);
$query = $_GET['sql'];
echo $query;
?>
Using the script with 'small' values for the parameter sql works fine.
Although, using the script with the sql query as specified below

<SNIP very long url>

I do not understand why the value of the sql parameter is truncated. Any
help is appreciated!!

The GET string has a maximum, both by HTTP design and browser limitations,
and you probably reached it (anyone willing to look up what that exact
maximum is?).

You shouldn't try to get this in a GET, just use POST.

--
Rik Wasmus

[Ramon]

Re: _GET['name'] truncates

The length of the string is +/= 1200 characters. The maximum for IE is 2048,
and for other browsers even longer...

"Rik" <luiheidsgoeroe @hotmail.comwro te in message
news:op.tnaif7m nqnv3q9@misant. kabel.utwente.n l...
Ramon <info@kwekerijs chiffelers.nlwr ote:

Hi all,
>
I've written a php script, called test.php, consisting of the following
statements:
>
<?php
error_reporting (E_ALL);
$query = $_GET['sql'];
echo $query;
?>
Using the script with 'small' values for the parameter sql works fine.
Although, using the script with the sql query as specified below

<SNIP very long url>

I do not understand why the value of the sql parameter is truncated. Any
help is appreciated!!

The GET string has a maximum, both by HTTP design and browser limitations,
and you probably reached it (anyone willing to look up what that exact
maximum is?).

You shouldn't try to get this in a GET, just use POST.

--
Rik Wasmus

[Rik]

Re: _GET['name'] truncates

Ramon <info@kwekerijs chiffelers.nlwr ote:

The length of the string is +/= 1200 characters. The maximum for IE is
2048,
and for other browsers even longer...
>

Hmmz, you're right. I've tested it, and here it works perfectly.
rawurlencoded yields about 1270 characters, and I can get them back nicely
without any trouble, the full string.

Seems a configuration issue of either PHP, browser of webserver to me, but
I'm not going to find out: it still seems very silly to me to try this in
a GET.
--
Rik Wasmus

[Jerry Stuckle]

Re: _GET['name'] truncates

Rik wrote:

Ramon <info@kwekerijs chiffelers.nlwr ote:
>

>The length of the string is +/= 1200 characters. The maximum for IE is
>2048,
>and for other browsers even longer...
>>

>
Hmmz, you're right. I've tested it, and here it works perfectly.
rawurlencoded yields about 1270 characters, and I can get them back
nicely without any trouble, the full string.
>
Seems a configuration issue of either PHP, browser of webserver to me,
but I'm not going to find out: it still seems very silly to me to try
this in a GET.
--Rik Wasmus

Yep, in addition, it's very insecure. I could just put in my browser
windows

http://www.example.com?sql=delete%20from%20orders

You shouldn't even attempt to put a sql statement in the $_GET or $_POST
string. Rather, put only the values you need for the query.

Or save the query in the $_SESSION.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[=?iso-8859-1?Q?Kim_Andr=E9_Aker=F8?=]

Re: _GET['name'] truncates

Jerry Stuckle wrote:

Rik wrote:

Ramon <info@kwekerijs chiffelers.nlwr ote:

The length of the string is +/= 1200 characters. The maximum for
IE is 2048, and for other browsers even longer...
>

Hmmz, you're right. I've tested it, and here it works perfectly.
rawurlencoded yields about 1270 characters, and I can get them back
nicely without any trouble, the full string.

Seems a configuration issue of either PHP, browser of webserver to
me, but I'm not going to find out: it still seems very silly to me
to try this in a GET. --Rik Wasmus

>
Yep, in addition, it's very insecure. I could just put in my browser
windows
>
http://www.example.com?sql=delete%20from%20orders

Or even worse (just to prove a point to the OP):
http://www.example.com?sql=drop%20table%20orders

You shouldn't even attempt to put a sql statement in the $_GET or
$_POST string. Rather, put only the values you need for the query.
>
Or save the query in the $_SESSION.

--
Kim André Akerø
- kimandre@NOSPAM betadome.com
(remove NOSPAM to contact me directly)

[Toby A Inkster]

Re: _GET['name'] truncates

Jerry Stuckle wrote:

http://www.example.com?sql=delete%20from%20orders

Given the sample code posted:

<?php
error_reporting (E_ALL);
$query = $_GET['sql'];
echo $query;
?>

Your query would just print:

delete from orders

Which would not be insecure in the slightest -- after all, the script
doesn't even open a database connection!

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Geek of ~ HTML/CSS/Javascript/SQL/Perl/PHP/Python*/Apache/Linux

* = I'm getting there!

[Jerry Stuckle]

Re: _GET['name'] truncates

Toby A Inkster wrote:

Jerry Stuckle wrote:
>

>http://www.example.com?sql=delete%20from%20orders

>
Given the sample code posted:
>
<?php
error_reporting (E_ALL);
$query = $_GET['sql'];
echo $query;
?>
>
Your query would just print:
>
delete from orders
>
Which would not be insecure in the slightest -- after all, the script
doesn't even open a database connection!
>

Don't be dense, Tony. This is obviously some debug code. In the real
code he would be opening the connection and executing the sql.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Toby A Inkster]

Re: _GET['name'] truncates

Jerry Stuckle wrote:

Don't be dense, Tony. This is obviously some debug code. In the real
code he would be opening the connection and executing the sql.

That's your assumption.

My assumption is that in the real code, *if* he opened a connection to the
database, then he'd be sure to authenticate the user first, by at least
username/password and preferably IP address too.

Besides which, there are perfectly good reasons you might want to pass a
SQL query to a script that does not execute it. For example:

http://developer.mimer.com/validator/

http://www.phpclasses.org/browse/package/1484.html

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Geek of ~ HTML/CSS/Javascript/SQL/Perl/PHP/Python*/Apache/Linux

* = I'm getting there!

[Rik]

Re: _GET['name'] truncates

Toby A Inkster <usenet200701@t obyinkster.co.u kwrote:

Jerry Stuckle wrote:
>

>Don't be dense, Tony. This is obviously some debug code. In the real
>code he would be opening the connection and executing the sql.

>
That's your assumption.
>
My assumption is that in the real code, *if* he opened a connection to
the
database, then he'd be sure to authenticate the user first, by at least
username/password and preferably IP address too.
>
Besides which, there are perfectly good reasons you might want to pass a
SQL query to a script that does not execute it.

Sure there are. And all of them are better served with a POST.
--
Rik Wasmus

[Curtis]

Re: _GET['name'] truncates

On Mon, 05 Feb 2007 23:10:36 -0800, Rik <luiheidsgoeroe @hotmail.comwro te:

Toby A Inkster <usenet200701@t obyinkster.co.u kwrote:
>

>Jerry Stuckle wrote:
>>

>>Don't be dense, Tony. This is obviously some debug code. In the real
>>code he would be opening the connection and executing the sql.

>>
>That's your assumption.
>>
>My assumption is that in the real code, *if* he opened a connection to
>the
>database, then he'd be sure to authenticate the user first, by at least
>username/password and preferably IP address too.
>>
>Besides which, there are perfectly good reasons you might want to pass a
>SQL query to a script that does not execute it.

>
Sure there are. And all of them are better served with a POST.

Unless you specifically want the page state bookmarkable.

--
Curtis, http://dyersweb.com