no insert ...

[Mark Knochen]

Hello,

i have a php-script with a mysql_query ...

$insert = mysql_query("IN SERT INTO $table (textID,redakti on) VALUES
('$_POST[ID]','$row_startse iten[ID]')");

I get no mysql_error, if i copy the insert directly into phpmyadmin, the
insert works. but with the php-script the insert doesn`t create a new
row in the table .. but why?

thank you for help

Mark
--
www.zeitfuerwahrheit.de

*************** *************** *************** *************** ************
*
Beim großen Manual, ich habe gesprochen! *
*
*************** *************** *************** *************** ************
*
"Ich habe Dinge gesehen, die ihr Menschen niemals glauben würdet. *
Gigantische Schiffe, die brannten, draußen vor der Schulter des Orion. *
Und ich habe C-Beams gesehen, glitzernd im Dunkel, *
nahe dem Thannhäuser-Tor. *
All diese Momente werden verloren sein... in der Zeit, *
so wie ... Tränen im Regen." *
*
*************** *************** *************** *************** ************

[=?UTF-8?B?TWljaGHFgiBXb8W6bmlhaw==?=]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mark Knochen wrote:

Hello,

i have a php-script with a mysql_query ...

$insert = mysql_query("IN SERT INTO $table (textID,redakti on) VALUES
('$_POST[ID]','$row_startse iten[ID]')");

I get no mysql_error, if i copy the insert directly into phpmyadmin, the
insert works. but with the php-script the insert doesn`t create a new
row in the table .. but why?

thank you for help

Mark

surely you are not pasting *exactly* the above - you are replacing
$_POST[ID], for example. I'd do one thing:
echo $insert;
you could see, what actually gets sent to the mysql server. I bet the
problem's there.

besides, using bare $_POST var in a query is *not* a good idea, that's the
best way to get sql-injected. you _should_ do some checks on the value of
$_POST[ID].

cheers
mike

- --
well, whatever, nevermind
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFhdVobAD v+Yd2wmARAls7AJ 9poawMOwSzCojub J7pDRQeh3UKFwCc CoHw
2Hbc1gm6pzH0gIt PwEcu+lI=
=5b5W
-----END PGP SIGNATURE-----

[=?UTF-8?B?SXbDoW4gU8OhbmNoZXogT3J0ZWdh?=]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mark Knochen wrote:

$insert = mysql_query("IN SERT INTO $table (textID,redakti on) VALUES
('$_POST[ID]','$row_startse iten[ID]')");

I get no mysql_error, if i copy the insert directly into phpmyadmin, the
insert works. but with the php-script the insert doesn`t create a new
row in the table .. but why?

Because of how the variable expansion works. do an echo() of that
double-quoted string when running your script, and you'll see the error
clearly.

So, please RTFM, on the "Data types: string" chapter. And learn to use curly
braces when putting variables inside a double-quoted string.

- --
- ----------------------------------
Iván Sánchez Ortega -ivansanchez-algarroba-escomposlinux-punto-org-

El diablo, harto de carne, se metió fraile.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFhdb4R56 dWuhgxGgRAjpyAK CRaHmgkbf7hKhVR VgAl45SMhWcSgCg lvtI
9bMd0oFLzjqsiXL XYjMW6rU=
=BfUC
-----END PGP SIGNATURE-----

[Rik]

Iván Sánchez Ortega wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mark Knochen wrote:

>$insert = mysql_query("IN SERT INTO $table (textID,redakti on) VALUES
('$_POST[ID]','$row_startse iten[ID]')");

I get no mysql_error, if i copy the insert directly into phpmyadmin,
the insert works. but with the php-script the insert doesn`t
create a new
row in the table .. but why?

Because of how the variable expansion works. do an echo() of that
double-quoted string when running your script, and you'll see the
error clearly.

So, please RTFM, on the "Data types: string" chapter. And learn to
use curly braces when putting variables inside a double-quoted string.

And always, always, always * quote array keys (unless you use a variable
offcourse).


* always = if you feel like it
always, always = most of the time
always, always, always = 99,9% of the time.

At least, that seems to be the way people percieve it.
--
Rik Wasmus

[=?UTF-8?B?SXbDoW4gU8OhbmNoZXogT3J0ZWdh?=]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rik wrote:

* always = if you feel like it
always, always = most of the time
always, always, always = 99,9% of the time.

At least, that seems to be the way people percieve it.

There is no avail insisting... people will keep on making mistakes like
forgetting using mysql_real_esca pe_string() to avoid SQL injections.

- --
- ----------------------------------
Iván Sánchez Ortega -ivansanchez-algarroba-escomposlinux-punto-org-

Es tan corto el amor y tan largo el olvido.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFhdrvR56 dWuhgxGgRAr3YAK C+JmvaIf9Jm7q7T gE+xCsiPe5/BQCeLBXX
JshfeU8VxDiXjNb MGmB7fEk=
=2Bw5
-----END PGP SIGNATURE-----

[Marcin Dobrucki]

Mark Knochen wrote:

I get no mysql_error, if i copy the insert directly into phpmyadmin, the
insert works. but with the php-script the insert doesn`t create a new
row in the table .. but why?

Easy way to check this kind of problem is to enable logging on the
database, and see what the actual insert statement looks like after its
parsed out by the script. Then copy/paste that into your db, and see
what error it throws at you.

/m

[Erwin Moller]

Iván Sánchez Ortega wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Rik wrote:

>* always = if you feel like it
always, always = most of the time
always, always, always = 99,9% of the time.

At least, that seems to be the way people percieve it.

There is no avail insisting... people will keep on making mistakes like
forgetting using mysql_real_esca pe_string() to avoid SQL injections.

Hi Ivan,

Allow me to drop in here with a question.
I use ADODB lib (www.phplens.com/adodb) as a databaseabstrac tionlayer.
It has a funtion named qstr() that will make a string ready to use in an
insert or update statement.
I checked the sourcecode and noticed for mySQL it branches code on
magic_quotes_gp c.

if magicquotes are on if leaves the string as is.
Otherwise it uses mysql_real_esca pe_string().

But since mysql_real_esca pe_string() escapes more than addslashes(), I
wonder if adodb is doing the right thing.

addslashes works on: ", ', \, and the NULL-byte
mysql_real_esca pe_string works on: \x00, \n, \r, \, ', " and \x1a.

So \n, \r, \x1a are NOT escaped.
Can any of these be used for SQL-injection?

Regards,
Erwin Moller

>
- --
- ----------------------------------
Iván Sánchez Ortega -ivansanchez-algarroba-escomposlinux-punto-org-

Es tan corto el amor y tan largo el olvido.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFhdrvR56 dWuhgxGgRAr3YAK C+JmvaIf9Jm7q7T gE+xCsiPe5/BQCeLBXX
JshfeU8VxDiXjNb MGmB7fEk=
=2Bw5
-----END PGP SIGNATURE-----

[=?UTF-8?B?SXbDoW4gU8OhbmNoZXogT3J0ZWdh?=]

Erwin Moller wrote:

I use ADODB lib (www.phplens.com/adodb) as a databaseabstrac tionlayer.
It has a funtion named qstr() that will make a string ready to use in an
insert or update statement.

Quick reminder, guys: *ALWAYS* use these kind of functions before putting a
string into *ANY* SQL statement.

Yeah, that means that "select" statements are vulnerable to injections too.
And any other SQL statement you can think of, is too, if it includes a
user-defined string.

if magicquotes are on if leaves the string as is.
Otherwise it uses mysql_real_esca pe_string().

But since mysql_real_esca pe_string() escapes more than addslashes(), I
wonder if adodb is doing the right thing.

addslashes works on: ", ', \, and the NULL-byte
mysql_real_esca pe_string works on: \x00, \n, \r, \, ', " and \x1a.

So \n, \r, \x1a are NOT escaped.
Can any of these be used for SQL-injection?

[...]

For a SQL injection to be sucessful, the attacker must include a quote. If
you escape the quotes, you *should* be safe. Inserting a line break will
most likely stop the execution of the SQL statement.
But, in case of doubt, please use a vulnerability check suite: they'll try
every SQL injection system known. I can't recall the names of any right
now, so STFW to find 'em.

--
----------------------------------
Iván Sánchez Ortega -ivansanchez-algarroba-escomposlinux-punto-org-

Un ordenador no es un televisor ni un microondas, es una herramienta
compleja.