Re: pdo ?

On Jan 24, 2013, at 2:15 PM, Matt Pelmear wrote:

> On 01/24/2013 12:00 PM, Jim Giner wrote:
>> On 1/24/2013 1:41 PM, Richard Quadling wrote:
>>> On 24 January 2013 17:48, Matt Pelmear <[email protected]> wrote:
>>>> On 01/24/2013 09:23 AM, Jim Giner wrote:
>>>>>
>>>>> On 1/24/2013 12:05 PM, Matt Pelmear wrote:
>>>>>>
>>>>>>
>>>>>> http://stackoverflow.com/questions/5801951/does-php-auto-escapes-quotes-in-string-which-is-passed-by-get-or-post
>>>>>>
>>>>>>
>>>>>> Every pro has this feature (magic_quotes_gpc) turned off. If you
>>>>>> understand SQL Injection vulnerabilities, and properly bind  
>>>>>> things into
>>>>>> your queries, I would recommend disabling it.
>>>>>>
>>>>>> -Matt
>>>>>>
>>>>>> On 01/24/2013 08:55 AM, Jim Giner wrote:
>>>>>>>
>>>>>>> ok - new to using pdo functions, but I thought I had a handle  
>>>>>>> on it.
>>>>>>>
>>>>>>> I'm writing out to my page an input tag with the following  
>>>>>>> value in it:
>>>>>>>
>>>>>>> 49'ers
>>>>>>>
>>>>>>> I can confirm it by using my browser's "view source" to see  
>>>>>>> that is
>>>>>>> exactly how it exists in the page.
>>>>>>>
>>>>>>> When I hit a submit button and my script retrieves the 'post'  
>>>>>>> vars my
>>>>>>> debugging steps are showing that the var $_POST['team']  
>>>>>>> contains the
>>>>>>> above value with a backslash (\) already inserted. This is  
>>>>>>> causing me
>>>>>>> a problem when I then try to use pdo->quote to safely encode  
>>>>>>> it for
>>>>>>> updating my sql database.
>>>>>>>
>>>>>>> My question is - why does the POST var show the \ char before I
>>>>>>> execute the 'quote' function?
>>>>>>>
>>>>>>
>>>>> You're right!  But I must not understand something.
>>>>>
>>>>> My root folder has a php.ini file with the magic quotes set off.  
>>>>> Doesn't
>>>>> that carry on down to folders beneath it?
>>>>>
>>>>
>>>> I would check phpinfo() to see if it is being overridden.
>>>>
>>>> -Matt
>>>
>>> Create an info.php file containing ...
>>>
>>> <?php
>>> phpinfo();
>>>
>>> Save that in the directory containing PHP and one other directory.
>>>
>>> Load them via your browser. See the settings for the magic_xxxx and
>>> see where the php.ini configuration file is being loaded.
>>>
>>> It may be that your ini file is completely ignored!
>>>
>>>
>> Matt & Rich,
>>
>> I have a small php.ini in my domain's  'php' folder as well as in  
>> my webroot folder. I was under the impression that the overrides  
>> would be applied to all folders below my webroot, but apparently it  
>> is not happening.
>>
>> How do 'pros' replicate their .ini settings thru all of the  
>> application folder?  Not thru settings within the scripts I hope -  
>> I thought I read that the was not a very efficient way to do it and  
>> that a php.ini file was the best since it would be merged with the  
>> master one installed by my hoster.
>>
>
> Jim,
>
> Personally I rarely have the need to override the php.ini settings  
> for a particular host on a server. (Granted I never work in shared  
> servers)
> Assuming you are using Apache and the standard module configuration,  
> you can use .htaccess files to override many settings from php.ini
>
> Official reference pages:
> http://php.net/manual/en/configuration.changes.php  (you might want  
> to read through the comments here, too)
> http://httpd.apache.org/docs/current/howto/htaccess.html
>
> Example and some discussion here as well:
> http://davidwalsh.name/php-values-htaccess
>
> If you are using another web server or running PHP as FastCGI you  
> may need to consider other options (changing the setting globally or  
> doing a require_once() of your config changes?, or see the FastCGI  
> example here: http://www.askapache.com/php/php-htaccess-tips-tricks.html)
>
> -Matt
>
> -- 
> PHP Database Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>


You could just check for it with php and add or strip accordingly.

adding slashes if magic_quotes is disabled:

if (!get_magic_quotes_gpc()) {
	$var = addslashes($var);
}

stripping slashes if magic_quotes is enabled and your planning on  
sanitizing yourself.

if (get_magic_quotes_gpc()) {
	$var = stripslashes($var);
	//do your own sanitizing
}

I wouldn't suggest the last one if your not going to sanitize yourself  
as it will make you vulnerable.
But all-in-all very simple to implement.

Best,

Karl DeSaulniers
Design Drumm
http://designdrumm.com


-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php