MySQL/PHP: Check data length before INSERT?

[Randell D.]

Folks,

I've heard of buffer overflows being used/abused by hackers and believe one
method to reduce this from happening is to check the length of my form data
before writing it to my MySQL database.

Is my understanding correct?

At the moment, I pass all my data through htmlentities() before writing to
my database. Is this enough? Should I check each individual columns length
first, or perhaps the overall content length to fit within the maximum
record length?

I found a function called mysql_escape_string() and have thought of using
it - but other than strip_slashes(), I don't know the reverse (unless
strip_slashes() is the recommended opposite of mysql_escape_string()).

Can someone advise? Much appreciated,

--
Replies please... via the newsgroup, so everyone can learn...
Thanks,
Randell D.

[Aggro]

Randell D. wrote:

I've heard of buffer overflows being used/abused by hackers and believe one
method to reduce this from happening is to check the length of my form data
before writing it to my MySQL database.
MySQL should cut it for you, if it is too long to fit, but of course it
is smart ti check it before inserting it to table, because you never
know if there is a bug in MySQL.
At the moment, I pass all my data through htmlentities() before writing to
my database. Is this enough? Should I check each individual columns length
first, or perhaps the overall content length to fit within the maximum
record length?
Wouldn't it be smart to check it and inform the user that data doesn't
fit? That is propably better than just cuttting end off.
I found a function called mysql_escape_string() and have thought of using
it - but other than strip_slashes(), I don't know the reverse (unless
strip_slashes() is the recommended opposite of mysql_escape_string()).

You don't need to reverse mysql_escape_string() when reading. Just be
sure to call it before writing, because if you don't, you propably have
the most common security hole in your application.

[Randell D.]

"Aggro" <sp**********@yahoo.com> wrote in message
news:4I************@read3.inet.fi...

Randell D. wrote:

I've heard of buffer overflows being used/abused by hackers and believe one method to reduce this from happening is to check the length of my form data before writing it to my MySQL database.

MySQL should cut it for you, if it is too long to fit, but of course it
is smart ti check it before inserting it to table, because you never
know if there is a bug in MySQL.

At the moment, I pass all my data through htmlentities() before writing to my database. Is this enough? Should I check each individual columns length first, or perhaps the overall content length to fit within the maximum
record length?

Wouldn't it be smart to check it and inform the user that data doesn't
fit? That is propably better than just cuttting end off.

I found a function called mysql_escape_string() and have thought of using it - but other than strip_slashes(), I don't know the reverse (unless
strip_slashes() is the recommended opposite of mysql_escape_string()).

You don't need to reverse mysql_escape_string() when reading. Just be
sure to call it before writing, because if you don't, you propably have
the most common security hole in your application.

Thanks... I have javascript checks on the form field lengths - but my
concern was on folks who try to work their around these tests... I know
MySQL will cut the data but (and I'm probably mixing things up here) I have
read of some bugs being abused on an MS environment whereby hackers somehow
managed to write data after the NULL character (which would normally
terminate a string I think).

Hence I wanted to make sure I was writing the data in some environmentally
friendly way...

Thanks though,
randell d.

[Aggro]

Randell D. wrote:

Thanks... I have javascript checks on the form field lengths - but my
concern was on folks who try to work their around these tests... I know
MySQL will cut the data but (and I'm probably mixing things up here) I have
read of some bugs being abused on an MS environment whereby hackers somehow
managed to write data after the NULL character (which would normally
terminate a string I think).

If you use javascript to check the strings, you also need to do checking
at the server using php. You need to do this because:
- A lot of people don't have javascript or it isn't enabled, and they
deserver to know the error also, don't they?
- Security rule number 1: Always check that user input is valid.

Note, that you can still use javascript, if you think that you gain more
than lose with it:
- Extra work (implementation and upkeep)
- Some errors with some browsers might appear which won't look good in
the users eyes
+ It might decrease the server load a little, because in normal scenario
server needs to validate data only once (because javascript handles most
user errors without bothering server)
+ It might be more userfriendly in some cases. For example a counter
that counts the characters that user has inputted so that user can see
in real time how much more he/she can write.

[Agelmar]

Randell D. wrote:

"Aggro" <sp**********@yahoo.com> wrote in message
news:4I************@read3.inet.fi...

Randell D. wrote:

I've heard of buffer overflows being used/abused by hackers and
believe one method to reduce this from happening is to check the
length of my form data before writing it to my MySQL database.

MySQL should cut it for you, if it is too long to fit, but of course
it is smart ti check it before inserting it to table, because you
never know if there is a bug in MySQL.

At the moment, I pass all my data through htmlentities() before
writing to my database. Is this enough? Should I check each
individual columns length first, or perhaps the overall content
length to fit within the maximum record length?

Wouldn't it be smart to check it and inform the user that data
doesn't fit? That is propably better than just cuttting end off.

I found a function called mysql_escape_string() and have thought of
using it - but other than strip_slashes(), I don't know the reverse
(unless strip_slashes() is the recommended opposite of
mysql_escape_string()).

You don't need to reverse mysql_escape_string() when reading. Just be
sure to call it before writing, because if you don't, you propably
have the most common security hole in your application.

Thanks... I have javascript checks on the form field lengths - but my
concern was on folks who try to work their around these tests... I
know MySQL will cut the data but (and I'm probably mixing things up
here) I have read of some bugs being abused on an MS environment
whereby hackers somehow managed to write data after the NULL
character (which would normally terminate a string I think).

Alright, I'm going to jump in just to prevent any further confusion. A
buffer overrun is where you allocate a block of memory of fixed size, and
then read in an arbitrary amount of data which may run past the end of the
block of memory you have allocated (the buffer), overwriting memory that
could potentially be executed. Since you have no memory management abilities
in PHP, this is not anything that you as a user of PHP need to be concerned
about. It has nothing to do with writing past a null character, it's simply
a matter of reading in data of arbitrary size into a block of memory of
fixed size.

[David Mackenzie]

On Wed, 07 Jan 2004 05:32:05 GMT, "Randell D."
<re**********************@and.share.com> wrote:

At the moment, I pass all my data through htmlentities() before writing to
my database. Is this enough? Should I check each individual columns length
first, or perhaps the overall content length to fit within the maximum
record length?
You should store your data as raw as possible and only use
htmlentities() when outputting it in an HTML context.
I found a function called mysql_escape_string() and have thought of using
it - but other than strip_slashes(), I don't know the reverse (unless
strip_slashes() is the recommended opposite of mysql_escape_string()).

addslashes() and stripslashes()

--
David ( @priz.co.uk )

[Randell D.]

"Agelmar" <if**********@comcast.net> wrote in message
news:bt************@ID-30799.news.uni-berlin.de...

Randell D. wrote:

"Aggro" <sp**********@yahoo.com> wrote in message
news:4I************@read3.inet.fi...

Randell D. wrote:

I've heard of buffer overflows being used/abused by hackers and
believe one method to reduce this from happening is to check the
length of my form data before writing it to my MySQL database.

MySQL should cut it for you, if it is too long to fit, but of course
it is smart ti check it before inserting it to table, because you
never know if there is a bug in MySQL.

At the moment, I pass all my data through htmlentities() before
writing to my database. Is this enough? Should I check each
individual columns length first, or perhaps the overall content
length to fit within the maximum record length?

Wouldn't it be smart to check it and inform the user that data
doesn't fit? That is propably better than just cuttting end off.

I found a function called mysql_escape_string() and have thought of
using it - but other than strip_slashes(), I don't know the reverse
(unless strip_slashes() is the recommended opposite of
mysql_escape_string()).

You don't need to reverse mysql_escape_string() when reading. Just be
sure to call it before writing, because if you don't, you propably
have the most common security hole in your application.

Thanks... I have javascript checks on the form field lengths - but my
concern was on folks who try to work their around these tests... I
know MySQL will cut the data but (and I'm probably mixing things up
here) I have read of some bugs being abused on an MS environment
whereby hackers somehow managed to write data after the NULL
character (which would normally terminate a string I think).

Alright, I'm going to jump in just to prevent any further confusion. A
buffer overrun is where you allocate a block of memory of fixed size, and
then read in an arbitrary amount of data which may run past the end of the
block of memory you have allocated (the buffer), overwriting memory that
could potentially be executed. Since you have no memory management

abilities in PHP, this is not anything that you as a user of PHP need to be concerned about. It has nothing to do with writing past a null character, it's simply a matter of reading in data of arbitrary size into a block of memory of
fixed size.

Great - An answer... and one that I can understand too...

Cheers
Randell D.

[Randell D.]

"David Mackenzie" <[e-mail]> wrote in message
news:cf********************************@4ax.com...

On Wed, 07 Jan 2004 05:32:05 GMT, "Randell D."
<re**********************@and.share.com> wrote:

At the moment, I pass all my data through htmlentities() before writing tomy database. Is this enough? Should I check each individual columns lengthfirst, or perhaps the overall content length to fit within the maximum
record length?

You should store your data as raw as possible and only use
htmlentities() when outputting it in an HTML context.

I found a function called mysql_escape_string() and have thought of using
it - but other than strip_slashes(), I don't know the reverse (unless
strip_slashes() is the recommended opposite of mysql_escape_string()).

addslashes() and stripslashes()

--
David ( @priz.co.uk )

Thanks...