Re: pdo ?

On 01/24/2013 01:37 PM, Karl DeSaulniers wrote:
>
> On Jan 24, 2013, at 2:15 PM, Matt Pelmear wrote:
>
>> On 01/24/2013 12:00 PM, Jim Giner wrote:
>>> On 1/24/2013 1:41 PM, Richard Quadling wrote:
>>>> On 24 January 2013 17:48, Matt Pelmear <[email protected]> wrote:
>>>>> On 01/24/2013 09:23 AM, Jim Giner wrote:
>>>>>>
>>>>>> On 1/24/2013 12:05 PM, Matt Pelmear wrote:
>>>>>>>
>>>>>>>
>>>>>>> http://stackoverflow.com/questions/5801951/does-php-auto-escapes-quotes-in-string-which-is-passed-by-get-or-post 
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> Every pro has this feature (magic_quotes_gpc) turned off. If you
>>>>>>> understand SQL Injection vulnerabilities, and properly bind 
>>>>>>> things into
>>>>>>> your queries, I would recommend disabling it.
>>>>>>>
>>>>>>> -Matt
>>>>>>>
>>>>>>> On 01/24/2013 08:55 AM, Jim Giner wrote:
>>>>>>>>
>>>>>>>> ok - new to using pdo functions, but I thought I had a handle 
>>>>>>>> on it.
>>>>>>>>
>>>>>>>> I'm writing out to my page an input tag with the following 
>>>>>>>> value in it:
>>>>>>>>
>>>>>>>> 49'ers
>>>>>>>>
>>>>>>>> I can confirm it by using my browser's "view source" to see 
>>>>>>>> that is
>>>>>>>> exactly how it exists in the page.
>>>>>>>>
>>>>>>>> When I hit a submit button and my script retrieves the 'post' 
>>>>>>>> vars my
>>>>>>>> debugging steps are showing that the var $_POST['team'] 
>>>>>>>> contains the
>>>>>>>> above value with a backslash (\) already inserted. This is 
>>>>>>>> causing me
>>>>>>>> a problem when I then try to use pdo->quote to safely encode it 
>>>>>>>> for
>>>>>>>> updating my sql database.
>>>>>>>>
>>>>>>>> My question is - why does the POST var show the \ char before I
>>>>>>>> execute the 'quote' function?
>>>>>>>>
>>>>>>>
>>>>>> You're right!  But I must not understand something.
>>>>>>
>>>>>> My root folder has a php.ini file with the magic quotes set off. 
>>>>>> Doesn't
>>>>>> that carry on down to folders beneath it?
>>>>>>
>>>>>
>>>>> I would check phpinfo() to see if it is being overridden.
>>>>>
>>>>> -Matt
>>>>
>>>> Create an info.php file containing ...
>>>>
>>>> <?php
>>>> phpinfo();
>>>>
>>>> Save that in the directory containing PHP and one other directory.
>>>>
>>>> Load them via your browser. See the settings for the magic_xxxx and
>>>> see where the php.ini configuration file is being loaded.
>>>>
>>>> It may be that your ini file is completely ignored!
>>>>
>>>>
>>> Matt & Rich,
>>>
>>> I have a small php.ini in my domain's  'php' folder as well as in my 
>>> webroot folder. I was under the impression that the overrides would 
>>> be applied to all folders below my webroot, but apparently it is not 
>>> happening.
>>>
>>> How do 'pros' replicate their .ini settings thru all of the 
>>> application folder?  Not thru settings within the scripts I hope - I 
>>> thought I read that the was not a very efficient way to do it and 
>>> that a php.ini file was the best since it would be merged with the 
>>> master one installed by my hoster.
>>>
>>
>> Jim,
>>
>> Personally I rarely have the need to override the php.ini settings 
>> for a particular host on a server. (Granted I never work in shared 
>> servers)
>> Assuming you are using Apache and the standard module configuration, 
>> you can use .htaccess files to override many settings from php.ini
>>
>> Official reference pages:
>> http://php.net/manual/en/configuration.changes.php  (you might want 
>> to read through the comments here, too)
>> http://httpd.apache.org/docs/current/howto/htaccess.html
>>
>> Example and some discussion here as well:
>> http://davidwalsh.name/php-values-htaccess
>>
>> If you are using another web server or running PHP as FastCGI you may 
>> need to consider other options (changing the setting globally or 
>> doing a require_once() of your config changes?, or see the FastCGI 
>> example here: 
>> http://www.askapache.com/php/php-htaccess-tips-tricks.html)
>>
>> -Matt
>>
>> -- 
>> PHP Database Mailing List (http://www.php.net/)
>> To unsubscribe, visit: http://www.php.net/unsub.php
>>
>
>
> You could just check for it with php and add or strip accordingly.
>
> adding slashes if magic_quotes is disabled:
>
> if (!get_magic_quotes_gpc()) {
>     $var = addslashes($var);
> }
>
> stripping slashes if magic_quotes is enabled and your planning on 
> sanitizing yourself.
>
> if (get_magic_quotes_gpc()) {
>     $var = stripslashes($var);
>     //do your own sanitizing
> }
>
> I wouldn't suggest the last one if your not going to sanitize yourself 
> as it will make you vulnerable.
> But all-in-all very simple to implement.
>
> Best,
>
> Karl DeSaulniers
> Design Drumm
> http://designdrumm.com
>
>

You shouldn't be sanitizing using addslashes() regardless, or using 
magic_quotes_gpc at all really, if you can help it.
See: http://php.net/manual/en/security.magicquotes.whynot.php 
(magic_quotes was deprecated because it is bad.)

-Matt


-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php