I've a script which Takes $_POST['messages'] and then saves the user's messages to MySQL database.  What's the best approach to prevent SQL Injection and saving the messages(which could be alphabets, numbers, special characters) to the Database so that it won't affect the script+databse queries.  I mean, is there any approach to encode the data or change the special characters to encoded characters like ? to %3F so something.  I'm using PHP, MySQL(MySQL PDO Wrapper Class).
73
If user input is inserted without modification into an SQL query, then the application becomes vulnerable to , like in the following example:  $unsafe_variable = $_POST['user_input'];   mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')");   That's because the user can input something like value'); DROP TABLE table;--, and the query becomes:  INSERT INTO `table` (`column`) VALUES('value'); DROP TABLE table;--')   What can be done to prevent this from happening?
44395
I have an application written in PHP with Laravel that regularly prepares and executes statements like this:     -- All parameters are varchar(10)    SELECT c1, c2, c3, c4       from MyBigTable      where is_active = 1        and c1 in (@P1, @P2, @P3, @P4 ... @P250)        AND c2 is not NULL   Users have a big data grid, and they can select many rows (there is even a button to select 'ALL'). If they select 250 rows, this statement is what happens. But it takes more than one minute to run, which is unacceptable.  Table MyBigTable has about 10 millions rows. The estimated execution plan shows that 100% of time is spent on an "index seek, non-clustered". From this I deduce that the situation can not be improved using indexes, and that the only issue is in the use of prepared statements. (If you think I am wrong, just let me know). Moreover, I understand that these prepared statements are prepared, used once and discarded, so I don't think they are really beneficial.  What recommendation should I give to the developers?  Should I just tell them to stop using prepared statements, and hardcode the 250 values in the query?  Or should I give them some workaround, like the use of temporary tables (make a temporary table, insert 250 values, then make a query on MyBigTable JOINed with temp)?  Or any other idea?  EDIT: execution plan
17694
I can read the MySQL documentation and it's pretty clear. But, how does one decide which character set to use? On what data does collation have an effect?  I'm asking for an explanation of the two and how to choose them.
38011
I am developing a PHP application in which I am in need to store values bigger than 1 million, but with the flexibility of having floating points. I know the traditional float and double. I am looking to store only up to two decimal points, and will only handle operations with numbers that have 2 decimals exclusively.  I have chosen my column type of double and unsigned, but whenever I store a row with a value bigger than one million, it gets truncated to 999999.99  Why is this? I am looking for the right datatype/solution. If you could point me in the right direction, I will appreciate it a lot!  Thank you for your time in advance!  Cheers.
55459
I'm writing a command line tool to help my web app. It needs a password to connect to the service. I'd like the script to show a password prompt so I don't have to pass it as a command line argument.   That's easy enough, but I'd like it to not echo the password to the screen as it's typed. How can I do this with PHP?   Bonus points for doing it in pure PHP (no system('stty')) and replacing the characters with *.   EDIT:  The script will run on a unix like system (linux or mac). The script is written in PHP, and will most likely stay like that.  Also, for the record, the stty way of doing it is:  echo "Password: "; system('stty -echo'); $password = trim(fgets(STDIN)); system('stty echo'); // add a new line since the users CR didn't echo echo "\n";   I'd prefer to not have the system() calls in there.
7387
Can someone explain SQL injection?  How does it cause vulnerabilities?  Where exactly is the point where SQL is injected?
53551
Some of my script are using different encoding, and when I try to combine them, this has becom an issue.  But I can't change the encoding they use, instead I want to change the encodig of the result from script A, and use it as parameter in script B.   So: is there any simple way to change a string from UTF-8 to ISO-88591 in PHP? I have looked at utf_encode and _decode, but they doesn't do what i want. Why doesn't there exsist any "utf2iso()"-function, or similar?  I don't think I have characters that can't be written in ISO-format, so that shouldn't be an huge issue.
39428
I'm looking to find records in a table that match a specific number that the user enters.  So, the user may enter 12345, but this could be 123zz4-5 in the database. I imagine something like this would work, if PHP functions worked in MySQL. SELECT * FROM foo WHERE preg_replace(&quot;/[^0-9]/&quot;,&quot;&quot;,bar) = '12345'  What's the equivalent function or way to do this with just MySQL? Speed is not important.
6195
Using PHP, what's the fastest way to convert a string like this: "123" to an integer?  Why is that particular method the fastest? What happens if it gets unexpected input, such as "hello" or an array?
47519
Every time a user posts something containing &lt; or &gt; in a page in my web application, I get this exception thrown.  I don't want to go into the discussion about the smartness of throwing an exception or crashing an entire web application because somebody entered a character in a text box, but I am looking for an elegant way to handle this.  Trapping the exception and showing     An error has occurred please go back and re-type your entire form again, but this time please do not use &lt;   doesn't seem professional enough to me.  Disabling post validation (validateRequest="false") will definitely avoid this error, but it will leave the page vulnerable to a number of attacks.  Ideally: When a post back occurs containing HTML restricted characters, that posted value in the Form collection will be automatically HTML encoded. So the .Text property of my text-box will be something &amp; lt; html &amp; gt;  Is there a way I can do this from a handler?
7196
Is there an easy way to run a MySQL query from the Linux command line and output the results in  format?  Here's what I'm doing now:  mysql -u uid -ppwd -D dbname &lt;&lt; EOQ | sed -e 's/        /,/g' | tee list.csv select id, concat("\"",name,"\"") as name from students EOQ   It gets messy when there are a lot of columns that need to be surrounded by quotes, or if there are quotes in the results that need to be escaped.
14520
For example, mysql quote table name using   SELECT * FROM `table_name`;   notice the `   Does other database ever use different char to quote their table name
22775
Is there a library or acceptable method for sanitizing the input to an html page?  In this case I have a form with just a name, phone number, and email address.    Code must be C#.  For example:  "&lt;script src='bobs.js'&gt;John Doe&lt;/script&gt;" should become "John Doe"
3752
I have PHP configured so that magic quotes are on and register globals are off.  I do my best to always call htmlentities() for anything I am outputing that is derived from user input.  I also occasionally seach my database for common things used in xss attached such as...  &lt;script   What else should I be doing and how can I make sure that the things I am trying to do are always done.
89886
According to the , in order to make code more portable, they recommend using something like the following for escaping data:  if (!get_magic_quotes_gpc()) {     $lastname = addslashes($_POST['lastname']); } else {     $lastname = $_POST['lastname']; }   I have other validation checks that I will be performing, but how secure is the above strictly in terms of escaping data? I also saw that magic quotes will be deprecated in PHP 6. How will that affect the above code? I would prefer not to have to rely on a database-specific escaping function like mysql_real_escape_string().
93580
I'm working with a MySQL database that has some data imported from . The data contains non- characters (em dashes, etc.) as well as hidden carriage returns or line feeds. Is there a way to find these records using MySQL?
53910
I have a form where the user can input datetime and then I want to store it in the database. Here's my schema :     'start' => array(           'type' => 'varchar', 'mysql_type' => 'datetime',           'not null' => FALSE,         ),   The form :     $form['add']['start'] = array(         '#type' => 'datetime',   '#default_value' => $date,       );   When I hit submit button, it shows me :     db_insert failed. Message = SQLSTATE[22007]: Invalid datetime format: 1292 Incorrect datetime value:...   What I got out of it was that the DateTime in Drupal is incompatible with MySQL's. Any suggestions or how should I process the value from the form so I can insert it into the db?  Alternatively, any way to convert DrupalDatetime into string?  (For what it's worth I also tried 'timestamp' as the MySQL type but it throws me the same error).