Bug #16895 Updated: Bad char encoding

From: Date: Tue, 30 Apr 2002 06:34:53 +0000
Subject: Bug #16895 Updated: Bad char encoding
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-6536@lists.php.net to get a copy of this message 
 ID:               16895
 Updated by:       yohgaki@php.net
 Reported By:      benoit.sibaud@rd.francetelecom.com
-Status:           Open
+Status:           Assigned
 Bug Type:         PostgreSQL related
 Operating System: GNU/Linux
 PHP Version:      4.1.2
-Assigned To:      
+Assigned To:      yohgaki


Previous Comments:
------------------------------------------------------------------------

[2002-04-29 03:45:49] benoit.sibaud@rd.francetelecom.com

Cf
http://lists.debian.org/debian-security/2002/debian-security-200204/msg00328.html

A bad char encoding between PHP and PostgreSQL (don't know which is
guilty here), followed by a bug in SQL queries in PostgreSQL can lead
to execute any SQL request.

Sample code here:

%<----------------------------------------
   $conn = pg_connect("dbname=" . BASE_DOC . " port=" . BASE_PORT
                    . " user=" . BASE_USER);
   $var="é\'; BAD REQUEST";
   pg_exec($conn, "SET client_encoding = 'LATIN1'");
   $request = "SELECT col FROM tab WHERE col='" . addslashes($var) .
"'";
%<----------------------------------------

See Debian-security archive for more details. Already tested on a
Debian Woody with PHP-cgi 4.1.2 (+php4-pgsql+php4-pear).

------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=16895&edit=1

Thread (4 messages)

« previous php.bugs (#6536) next »