1. Advertising
    y u no do it?

    Advertising (learn more)

    Advertise virtually anything here, with CPM banner ads, CPM email ads and CPC contextual links. You can target relevant areas of the site and show ads based on geographical location of the user if you wish.

    Starts at just $1 per CPM or $0.10 per CPC.

Just Venting... SQL Preparation

Discussion in 'MySQL' started by T0PS3O, Jun 17, 2005.

0
  1. #1
    How often do you run into a website that doesn't prepare data for database entry?

    It's a bloody beginners programming error and sites that claim to be 'big' have it all over the place.

    AskRobo Directory for instance. Submit a description with an apostrophe and you'll get:

    when clicking the confirmation links. It happended before so I dropped them a contact enquiry but now 3 months later they haven't fixed it.

    I've even seen it with e-commerce software providers. How silly is that?!

    Please, everyone, addslashes is such an easy PHP function and I'm sure other languages offer the same. Prepare data prior to dumping it into a database or you'll get pissed off customers like me.
     
    T0PS3O, Jun 17, 2005 IP
  2. exam

    exam Peon

    Messages:
    2,434
    Likes Received:
    120
    Best Answers:
    0
    Trophy Points:
    0
    #2
    Yeah I hear you tops. but just for the sake of knowledge, it is much better to use mysql_real_escape_string() (with MySQL) or one of the equivalents for other RDBMS. :D Couln't resist :p
     
    exam, Jun 18, 2005 IP
  3. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,333
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #3
    digitalpoint, Jun 18, 2005 IP
  4. T0PS3O

    T0PS3O Feel Good PLC

    Messages:
    13,219
    Likes Received:
    777
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Goes to show how many options, other than doing nothing, are out there.
     
    T0PS3O, Jun 18, 2005 IP
  5. exam

    exam Peon

    Messages:
    2,434
    Likes Received:
    120
    Best Answers:
    0
    Trophy Points:
    0
    #5
    I hardly ever disagree with you Shawn, but look at what php.net says about mysql_escape_sring
     
    exam, Jun 18, 2005 IP
  6. mushroom

    mushroom Peon

    Messages:
    369
    Likes Received:
    15
    Best Answers:
    0
    Trophy Points:
    0
    #6
    There are 2 kinds of servers out there when if comes to adding " \ "
    the ones that have "magic_quotes_gpc = On" and the ones that have it Off in the php.ini file.

    The ones that have it On add the " \ " for you, (most code is written for these)
    The ones that have it Off are a pain in the b***
     
    mushroom, Jun 18, 2005 IP
  7. digitalpoint

    digitalpoint Overlord of no one Staff

    Messages:
    38,333
    Likes Received:
    2,613
    Best Answers:
    462
    Trophy Points:
    710
    Digital Goods:
    29
    #7
    You are right of course... I never use them directly, I have a database class I use to wrap around all the PHP functions (I use the mysql escape real string function in my class). :) I was just didn't bother to look that close when I posted it. hehe oops
     
    digitalpoint, Jun 18, 2005 IP
  8. exam

    exam Peon

    Messages:
    2,434
    Likes Received:
    120
    Best Answers:
    0
    Trophy Points:
    0
    #8
    No prob, I'm just sort up a detail freak ;) BTW, I've been mulling over making a db class, just haven't gotten around to it yet. :D
     
    exam, Jun 19, 2005 IP
  9. T0PS3O

    T0PS3O Feel Good PLC

    Messages:
    13,219
    Likes Received:
    777
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Not when it comes to AdSense. Sorry for the corss-thread humor :D
     
    T0PS3O, Jun 19, 2005 IP
  10. exam

    exam Peon

    Messages:
    2,434
    Likes Received:
    120
    Best Answers:
    0
    Trophy Points:
    0
    #10
    LOL is an understatement :D Now you're destroying my self-esteem... bad shrink:mad:
     
    exam, Jun 19, 2005 IP
    T0PS3O likes this.
  11. davedx

    davedx Peon

    Messages:
    429
    Likes Received:
    21
    Best Answers:
    0
    Trophy Points:
    0
    #11
    Yeah, all the servers I've ever used had magic quotes on. I guess the bottom line is always TEST your code, if you can do UAT on it... don't assume code that's worked before will work in different configurations.
     
    davedx, Jun 22, 2005 IP
  12. exam

    exam Peon

    Messages:
    2,434
    Likes Received:
    120
    Best Answers:
    0
    Trophy Points:
    0
    #12
    You can always test to see if magic quotes is on or off at the beginning of your script, and act accordingly. Then you'll never run into a problem.
     
    exam, Jun 23, 2005 IP