Re: pdo ?

On 1/24/2013 6:03 PM, Matt Pelmear wrote:
> On 01/24/2013 01:37 PM, Karl DeSaulniers wrote:
>>
>> On Jan 24, 2013, at 2:15 PM, Matt Pelmear wrote:
>>
>>> On 01/24/2013 12:00 PM, Jim Giner wrote:
>>>> On 1/24/2013 1:41 PM, Richard Quadling wrote:
>>>>> On 24 January 2013 17:48, Matt Pelmear <[email protected]> wrote:
>>>>>> On 01/24/2013 09:23 AM, Jim Giner wrote:
>>>>>>>
>>>>>>> On 1/24/2013 12:05 PM, Matt Pelmear wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>> http://stackoverflow.com/questions/5801951/does-php-auto-escapes-quotes-in-string-which-is-passed-by-get-or-post
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> Every pro has this feature (magic_quotes_gpc) turned off. If you
>>>>>>>> understand SQL Injection vulnerabilities, and properly bind
>>>>>>>> things into
>>>>>>>> your queries, I would recommend disabling it.
>>>>>>>>
>>>>>>>> -Matt
>>>>>>>>
>>>>>>>> On 01/24/2013 08:55 AM, Jim Giner wrote:
>>>>>>>>>
>>>>>>>>> ok - new to using pdo functions, but I thought I had a handle
>>>>>>>>> on it.
>>>>>>>>>
>>>>>>>>> I'm writing out to my page an input tag with the following
>>>>>>>>> value in it:
>>>>>>>>>
>>>>>>>>> 49'ers
>>>>>>>>>
>>>>>>>>> I can confirm it by using my browser's "view source" to see
>>>>>>>>> that is
>>>>>>>>> exactly how it exists in the page.
>>>>>>>>>
>>>>>>>>> When I hit a submit button and my script retrieves the 'post'
>>>>>>>>> vars my
>>>>>>>>> debugging steps are showing that the var $_POST['team']
>>>>>>>>> contains the
>>>>>>>>> above value with a backslash (\) already inserted. This is
>>>>>>>>> causing me
>>>>>>>>> a problem when I then try to use pdo->quote to safely encode it
>>>>>>>>> for
>>>>>>>>> updating my sql database.
>>>>>>>>>
>>>>>>>>> My question is - why does the POST var show the \ char before I
>>>>>>>>> execute the 'quote' function?
>>>>>>>>>
>>>>>>>>
>>>>>>> You're right!  But I must not understand something.
>>>>>>>
>>>>>>> My root folder has a php.ini file with the magic quotes set off.
>>>>>>> Doesn't
>>>>>>> that carry on down to folders beneath it?
>>>>>>>
>>>>>>
>>>>>> I would check phpinfo() to see if it is being overridden.
>>>>>>
>>>>>> -Matt
>>>>>
>>>>> Create an info.php file containing ...
>>>>>
>>>>> <?php
>>>>> phpinfo();
>>>>>
>>>>> Save that in the directory containing PHP and one other directory.
>>>>>
>>>>> Load them via your browser. See the settings for the magic_xxxx and
>>>>> see where the php.ini configuration file is being loaded.
>>>>>
>>>>> It may be that your ini file is completely ignored!
>>>>>
>>>>>
>>>> Matt & Rich,
>>>>
>>>> I have a small php.ini in my domain's  'php' folder as well as in my
>>>> webroot folder. I was under the impression that the overrides would
>>>> be applied to all folders below my webroot, but apparently it is not
>>>> happening.
>>>>
>>>> How do 'pros' replicate their .ini settings thru all of the
>>>> application folder?  Not thru settings within the scripts I hope - I
>>>> thought I read that the was not a very efficient way to do it and
>>>> that a php.ini file was the best since it would be merged with the
>>>> master one installed by my hoster.
>>>>
>>>
>>> Jim,
>>>
>>> Personally I rarely have the need to override the php.ini settings
>>> for a particular host on a server. (Granted I never work in shared
>>> servers)
>>> Assuming you are using Apache and the standard module configuration,
>>> you can use .htaccess files to override many settings from php.ini
>>>
>>> Official reference pages:
>>> http://php.net/manual/en/configuration.changes.php  (you might want
>>> to read through the comments here, too)
>>> http://httpd.apache.org/docs/current/howto/htaccess.html
>>>
>>> Example and some discussion here as well:
>>> http://davidwalsh.name/php-values-htaccess
>>>
>>> If you are using another web server or running PHP as FastCGI you may
>>> need to consider other options (changing the setting globally or
>>> doing a require_once() of your config changes?, or see the FastCGI
>>> example here:
>>> http://www.askapache.com/php/php-htaccess-tips-tricks.html)
>>>
>>> -Matt
>>>
>>> --
>>> PHP Database Mailing List (http://www.php.net/)
>>> To unsubscribe, visit: http://www.php.net/unsub.php
>>>
>>
>>
>> You could just check for it with php and add or strip accordingly.
>>
>> adding slashes if magic_quotes is disabled:
>>
>> if (!get_magic_quotes_gpc()) {
>>     $var = addslashes($var);
>> }
>>
>> stripping slashes if magic_quotes is enabled and your planning on
>> sanitizing yourself.
>>
>> if (get_magic_quotes_gpc()) {
>>     $var = stripslashes($var);
>>     //do your own sanitizing
>> }
>>
>> I wouldn't suggest the last one if your not going to sanitize yourself
>> as it will make you vulnerable.
>> But all-in-all very simple to implement.
>>
>> Best,
>>
>> Karl DeSaulniers
>> Design Drumm
>> http://designdrumm.com
>>
>>
>
> You shouldn't be sanitizing using addslashes() regardless, or using
> magic_quotes_gpc at all really, if you can help it.
> See: http://php.net/manual/en/security.magicquotes.whynot.php
> (magic_quotes was deprecated because it is bad.)
>
> -Matt
>
And I'm not.

-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php