#44998 [Com]: mysqli_real_escape_string not properly escaping null characters

From: Date: Tue, 21 Oct 2008 00:38:51 +0000
Subject: #44998 [Com]: mysqli_real_escape_string not properly escaping null characters
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-129905@lists.php.net to get a copy of this message
 ID:               44998
 Comment by:       ian at city17 dot ca
 Reported By:      djneoform at gmail dot com
 Status:           Assigned
 Bug Type:         MySQLi related
 Operating System: Win2003 Standard
 PHP Version:      5.2.6
 Assigned To:      andrey
 New Comment:

Experienced the same thing when storing files in mysql. Many files end
up corrupt since the file ends before it was supposed to.


Previous Comments:
------------------------------------------------------------------------

[2008-07-24 14:23:20] djneoform at gmail dot com

The resulting dump for the table once i run the script.

/*
MySQL Data Transfer
Source Host: localhost
Source Database: phpneoform
Target Host: localhost
Target Database: phpneoform
Date: 7/24/2008 10:22:31 AM
*/

SET FOREIGN_KEY_CHECKS=0;
-- ----------------------------
-- Table structure for test_table
-- ----------------------------
CREATE TABLE test_table (
  id int(10) unsigned NOT NULL auto_increment,
  name binary(100) NOT NULL,
  PRIMARY KEY  (id)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=latin1;

-- ----------------------------
-- Records 
-- ----------------------------
INSERT INTO test_table VALUES ('1', 'AAAAAAAAAAAAAAAAAAAAAAAAA');

------------------------------------------------------------------------

[2008-07-24 14:20:36] djneoform at gmail dot com

Results:

TEST STRING LENGTH: 51
RETURNED STRING LENGTH: 100

------------------------------------------------------------------------

[2008-07-24 14:19:36] djneoform at gmail dot com

http://phpneoform.com/error.php

Here's this script running on a win2k3 server with PHP 5.2.6 and mysql
5.0.62

<?php
	
	$mysqli = new mysqli('localhost', 'xxx', 'xxx', 'xxx');

	$mysqli->query("DROP TABLE IF EXISTS test_table");
	$mysqli->query("
		CREATE TABLE test_table (
		  id int(10) unsigned NOT NULL auto_increment,
		  name binary(100) NOT NULL,
		  PRIMARY KEY  (id)
		) ENGINE=MyISAM DEFAULT CHARSET=latin1;
	");
	
	$str = str_repeat('A', 25).chr(0x0).str_repeat('B', 25);
	echo "TEST STRING LENGTH: ".strlen($str)."<br />\n";
	$mysqli->query("
		INSERT INTO 
			test_table
		SET
			name = '".$mysqli->real_escape_string($str)."'
	");
	$id = $mysqli->insert_id;
	
	$result = $mysqli->query("
		SELECT
			name
		FROM
			test_table
		WHERE
			id = '".intval($id)."'		
	");

	$result = $result->fetch_object();
	
	echo "RETURNED STRING LENGTH: ".strlen($result->name)."<br />\n";
?>

------------------------------------------------------------------------

[2008-07-24 13:37:53] andrey@php.net

 Hi,
Do you still experience it?
Can you reproduce it with a simple script?
Can you provide a dump or just the data, index + frm, considering you
are using MyISAM?

------------------------------------------------------------------------

[2008-07-14 18:16:27] djneoform at gmail dot com

I was using v.5.0.51b 64bit (win2k3) at the time.

Right now I'm using a compiled version of the enterprise code, 5.0.62
from apachelounge.com.

When I do an insert a value:

mysqli_real_escape_string('foo'.chr(0x0).'bar')

all i see in the table after is "foo"

maybe this is a windows only issue?

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/44998

-- 
Edit this bug report at http://bugs.php.net/?id=44998&edit=1



Thread (12 messages)

« previous php.bugs (#129905) next »