mcrypt blob upload problem to MySQL

[Sophisticado]

Greetings

I have a script in which I am collecting sensitive information via a
form (METHOD=POST) and encrypting the posted variable (format = BLOB)
using mcrypt, then saving it in a MySql table. Using my test
script,everythi ng works fine. Using my production scrypt, everything
works fine for data posted with fewer than 8 characters. If I try to
upload data longer than 8 characters, I get this error message:

You have an error in your SQL syntax; check the manual that corresponds
to your MySQL server version for the right syntax to use near 'ióU¹
”šC!ÊŒB', '01', '2004', NULL, '150')' at line 1

The characters ióU¹”šC!ÊŒB' after "near" are the encrypted characters.

There does not seem to be any difference between the test and production
scrypts.

Here is the syntax I am using for saving the record:

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "myTable"))
{
$insertSQL = sprintf("INSERT INTO myTable (`Date`, LastName,
FirstName, EcryptedBlob) VALUES (%s, %s, %s, %s)",
GetSQLValueStri ng($_POST['Date'], "text"),
GetSQLValueStri ng($_POST['Lastname'], "text"),
GetSQLValueStri ng($_POST['Firstname'], "text"),
GetSQLValueStri ng($encrypted," text"));

php v. 5.0.5
MySql v. 4.1.9
Any help would be appreciated.

[Andy Hassall]

On Wed, 30 Aug 2006 11:21:47 -0500, Sophisticado <Sophsiticadowr ote:

>I have a script in which I am collecting sensitive information via a
form (METHOD=POST) and encrypting the posted variable (format = BLOB)
using mcrypt, then saving it in a MySql table. Using my test
script,everyth ing works fine. Using my production scrypt, everything
works fine for data posted with fewer than 8 characters. If I try to
upload data longer than 8 characters, I get this error message:

You have an error in your SQL syntax; check the manual that corresponds
to your MySQL server version for the right syntax to use near 'ióU¹
?¨C!ʼB', '01', '2004', NULL, '150')' at line 1

The characters ióU¹?¨C!ʼB' after "near" are the encrypted characters.

There does not seem to be any difference between the test and production
scrypts.

Here is the syntax I am using for saving the record:

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "myTable"))
{
$insertSQL = sprintf("INSERT INTO myTable (`Date`, LastName,
FirstName, EcryptedBlob) VALUES (%s, %s, %s, %s)",
GetSQLValueStri ng($_POST['Date'], "text"),
GetSQLValueStri ng($_POST['Lastname'], "text"),
GetSQLValueStri ng($_POST['Firstname'], "text"),
GetSQLValueStri ng($encrypted," text"));

php v. 5.0.5
MySql v. 4.1.9

Where is "GetSQLValueStr ing" defined?

--
Andy Hassall :: an**@andyh.co.u k :: http://www.andyh.co.uk
http://www.andyhsoftware.co.uk/space :: disk and FTP usage analysis tool

[Sophisticado]

Andy Hassall <an**@andyh.co. ukwrote in
news:4l******** *************** *********@4ax.c om:

On Wed, 30 Aug 2006 11:21:47 -0500, Sophisticado <Sophsiticadowr ote:

>>I have a script in which I am collecting sensitive information via a
form (METHOD=POST) and encrypting the posted variable (format = BLOB)
using mcrypt, then saving it in a MySql table. Using my test
script,everyt hing works fine. Using my production scrypt, everything
works fine for data posted with fewer than 8 characters. If I try to
upload data longer than 8 characters, I get this error message:

You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near 'ióU¹

?¨C!ʼB', '01', '2004', NULL, '150')' at line 1

>>
The characters ióU¹?¨C!ʼB' after "near" are the encrypted characters.

There does not seem to be any difference between the test and
production scrypts.

Here is the syntax I am using for saving the record:

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] ==
"myTable")) {
$insertSQL = sprintf("INSERT INTO myTable (`Date`, LastName,
FirstName, EcryptedBlob) VALUES (%s, %s, %s, %s)",
GetSQLValueStri ng($_POST['Date'], "text"),
GetSQLValueStri ng($_POST['Lastname'], "text"),
GetSQLValueStri ng($_POST['Firstname'], "text"),
GetSQLValueStri ng($encrypted," text"));

php v. 5.0.5
MySql v. 4.1.9

Where is "GetSQLValueStr ing" defined?

Here is the function before the encryption at the top of the script:

function GetSQLValueStri ng($theValue, $theType, $theDefinedValu e = "",
$theNotDefinedV alue = "") {
$theValue = (!get_magic_quo tes_gpc()) ? addslashes($the Value) :
$theValue;

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValu e) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theV alue) . "'" :
"NULL"; break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValu e :
$theNotDefinedV alue; break;
}
return $theValue;
}

[Jerry Stuckle]

Sophisticado wrote:

Andy Hassall <an**@andyh.co. ukwrote in
news:4l******** *************** *********@4ax.c om:

>>On Wed, 30 Aug 2006 11:21:47 -0500, Sophisticado <Sophsiticadowr ote:

>>>I have a script in which I am collecting sensitive information via a
form (METHOD=POST) and encrypting the posted variable (format = BLOB)
using mcrypt, then saving it in a MySql table. Using my test
script,every thing works fine. Using my production scrypt, everything
works fine for data posted with fewer than 8 characters. If I try to
upload data longer than 8 characters, I get this error message:

You have an error in your SQL syntax; check the manual that
correspond s to your MySQL server version for the right syntax to use
near 'ióU¹

?¨C!ʼB', '01', '2004', NULL, '150')' at line 1

>>>The characters ióU¹?¨C!ʼB' after "near" are the encrypted characters.

There does not seem to be any difference between the test and
production scrypts.

Here is the syntax I am using for saving the record:

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] ==
"myTable") ) {
$insertSQL = sprintf("INSERT INTO myTable (`Date`, LastName,
FirstName, EcryptedBlob) VALUES (%s, %s, %s, %s)",
GetSQLValueStri ng($_POST['Date'], "text"),
GetSQLValueStri ng($_POST['Lastname'], "text"),
GetSQLValueStri ng($_POST['Firstname'], "text"),
GetSQLValueStri ng($encrypted," text"));

php v. 5.0.5
MySql v. 4.1.9

Where is "GetSQLValueStr ing" defined?

Here is the function before the encryption at the top of the script:

function GetSQLValueStri ng($theValue, $theType, $theDefinedValu e = "",
$theNotDefinedV alue = "") {
$theValue = (!get_magic_quo tes_gpc()) ? addslashes($the Value) :
$theValue;

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValu e) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theV alue) . "'" :
"NULL"; break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValu e :
$theNotDefinedV alue; break;
}
return $theValue;
}

Well, among other things, you should be using mysql_real_esca pe_string()
on all text values before you insert/update the database.
--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===