concatination & single quote

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • pradeep
    #1

    concatination & single quote

    Hi,

    I have a problem in PHP about Query of concating.
    Please, guide me

    1: test.sql is dump file

    -- PHP Version: 4.4.2
    --
    -- Database: `pradeep`
    --

    -- --------------------------------------------------------

    --
    -- Table structure for table `test`
    --

    CREATE TABLE `test` (
    `id` int(11) NOT NULL,
    `fullname` varchar(50) NOT NULL,
    PRIMARY KEY (`id`)
    ) ENGINE=MyISAM DEFAULT CHARSET=latin1;

    --
    -- Dumping data for table `test`
    --

    INSERT INTO `test` (`id`, `fullname`) VALUES (1, 'ankur patil'),
    (2, 'avinash chaudhary'),
    (3, 'raju za'),
    (4, 'tanmay wagh');


    2:bkslash.html

    <html>
    <body>
    <form action=bkslash2 .php method=post>
    <input type="text" name="input1">
    <select name=fields>
    <option value='id'>id</option>
    <option value=concat(co ncat(Fullname,' ,'),id)>Fullnam e & Id</option>
    </select>
    <input type=submit >
    </form>
    </body>
    </html>


    3:bkslash2.php
    <?php

    mysql_connect(" localhost","pro ex")or die("Database Failed");
    mysql_select_db ("pradeep")o r die("Failed to Connect Database");


    $str="select fullname from test where ".$_REQUEST['fields']." like '%".
    $_REQUEST['input1']."%'";
    echo $str;
    $res=mysql_quer y($str) or die("resultset error");
    $row=mysql_fetc h_row($res);

    echo "<br>result<hr> ";
    print_r($row);


    ?>





    here, in output, if i enter any value (let 3) in text box & in combo
    box
    select Fullname & id then it gives me resultant error
    & Query becomes
    select fullname from test where concat(concat(F ullname,\',\'), id) like
    '%3%'

    so, how i get right output ?

    Please, guide me.

    Tags: None
    • Rami Elomaa
      #2
      Re: concatination &amp; single quote

      pradeep kirjoitti:
      Hi,
      >
      I have a problem in PHP about Query of concating.
      Please, guide me
      >
      1: test.sql is dump file
      >
      -- PHP Version: 4.4.2
      --
      -- Database: `pradeep`
      --
      >
      -- --------------------------------------------------------
      >
      --
      -- Table structure for table `test`
      --
      >
      CREATE TABLE `test` (
      `id` int(11) NOT NULL,
      `fullname` varchar(50) NOT NULL,
      PRIMARY KEY (`id`)
      ) ENGINE=MyISAM DEFAULT CHARSET=latin1;
      >
      --
      -- Dumping data for table `test`
      --
      >
      INSERT INTO `test` (`id`, `fullname`) VALUES (1, 'ankur patil'),
      (2, 'avinash chaudhary'),
      (3, 'raju za'),
      (4, 'tanmay wagh');
      >
      >
      2:bkslash.html
      >
      <html>
      <body>
      <form action=bkslash2 .php method=post>
      <input type="text" name="input1">
      <select name=fields>
      <option value='id'>id</option>
      <option value=concat(co ncat(Fullname,' ,'),id)>Fullnam e & Id</option>
      </select>
      <input type=submit >
      </form>
      </body>
      </html>
      >
      >
      3:bkslash2.php
      <?php
      >
      mysql_connect(" localhost","pro ex")or die("Database Failed");
      mysql_select_db ("pradeep")o r die("Failed to Connect Database");
      >
      >
      $str="select fullname from test where ".$_REQUEST['fields']." like '%".
      $_REQUEST['input1']."%'";
      echo $str;
      $res=mysql_quer y($str) or die("resultset error");
      $row=mysql_fetc h_row($res);
      >
      echo "<br>result<hr> ";
      print_r($row);
      >
      >
      ?>
      >
      >
      >
      >
      >
      here, in output, if i enter any value (let 3) in text box & in combo
      box
      select Fullname & id then it gives me resultant error
      & Query becomes
      select fullname from test where concat(concat(F ullname,\',\'), id) like
      '%3%'
      >
      so, how i get right output ?
      >
      Please, guide me.
      >
      stripslashes($_ REQUEST['fields']);

      --
      Rami.Elomaa@gma il.com
      "Olemme apinoiden planeetalla."

        Comment

        • Toby A Inkster
          #3
          Re: concatination &amp; single quote

          pradeep wrote:
          <option value=concat(co ncat(Fullname,' ,'),id)>
          <option value="concat(c oncat(Fullname, ','),id)">
          $str="select fullname from test where ".$_REQUEST['fields']." like '%".
          $_REQUEST['input1']."%'";
          That line just scared the bejeezus out of me!

          Big, big security problem right here.

          --
          Toby A Inkster BSc (Hons) ARCS
          Contact Me ~ http://tobyinkster.co.uk/contact
          Geek of ~ HTML/SQL/Perl/PHP/Python*/Apache/Linux

          * = I'm getting there!

            Comment

            Previous template Next
            Working...