_giles_ Posted February 27, 2007 Share Posted February 27, 2007 Hi, I’ve run into some problems with EscapeShellArg() – wonder if you can help? I’ve been using it very successfully to place single quotes around inputted text {e.g. EscapeShellArg($answer)} to prevent meliciously keyed data being stored in my database. As said, all has been well, running on my localhost – however things are not so good after uploading it to my domain. I’m now getting MySQL syntax errors trying to write to my databases (e.g.) 'users answer'' WHERE session_id = '6tidcs36jq4bm3cceu9nnqbi16' at line 3 obviously the noicable fact is the double single quote at the end of the users answer, but I’m foxed as to where this is coming from. I’ve checked the syntax of the $answer parameter feeding the function and it’s fine, so there’s nowhere that can be adding this extra quote. The one clue, after checking versions is that there is a difference between my localhost ( running php4.3.10 MySQL 3.23.49 … ok, ok, I know it’s old) and my IP (php 5.0.4 MySQL 4.1.20), however I’ve checked EscapeShellArg() in the MySQL manual and there appears to be no reported issues in implementation. SO that’s as far as my newbie brain has gotten me. I’d appreciate any thoughts you might have. Thanks Giles Quote Link to comment https://forums.phpfreaks.com/topic/40403-problems-with-escapeshellarg/ Share on other sites More sharing options...
fenway Posted February 27, 2007 Share Posted February 27, 2007 I've never even heard of this function... Quote Link to comment https://forums.phpfreaks.com/topic/40403-problems-with-escapeshellarg/#findComment-195508 Share on other sites More sharing options...
ShogunWarrior Posted February 27, 2007 Share Posted February 27, 2007 I've never even heard of this function... escapeshellarg is a function, however it is only supposed to be used if the string is going to be passed as an argument to exec or system not to a database function. Quote Link to comment https://forums.phpfreaks.com/topic/40403-problems-with-escapeshellarg/#findComment-195556 Share on other sites More sharing options...
_giles_ Posted February 28, 2007 Author Share Posted February 28, 2007 Interesting! The corsework I've been following uses it to encapsulate keyed text inside single quotes before entering it into a database, the idea being that even malicious keystrokes will be seen as a string therefore not acted upon by the system. Your response makes it appear that this is not standard practise ... begs the question ... what is the standard practise to render malicious keystrokes harmless?? Quote Link to comment https://forums.phpfreaks.com/topic/40403-problems-with-escapeshellarg/#findComment-195897 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.