Bug #959: Magic Quotes in Oracle (replaces bug 957)

From: drew@elysium.demon.co.uk Operating system: Linux PHP version: 3.0.5 PHP Bug Type: Oracle related Bug description: Magic Quotes in Oracle (replaces bug 957) Oops - I had the args the wrong way round in the strstr calls !! Heres the newer version (bug 957's patch is wrong) :- When constructing a query for Oracle containing user supplied values ora_Parse will break if the user entered a value containing a ' such seaching an Oracle database for occurences of Bill's House. PHP quotes the single ' in the variable containg the search criteria with a \ (it becomes Bill\' House), oracle needs single a single quote to be quoted with another ' (it should be Bill''s House). The following patch will change a PHP quoted \' to a '' for submission to the Oracle SQL parse function. --- oracle.c.orig Mon Oct 5 01:22:29 1998 +++ oracle.c Mon Nov 30 11:19:25 1998 @@ -709,7 +709,7 @@ pval *argv[3]; oraCursor *cursor; sword defer = 0; - text *query; + text *query, *quote; argc = ARG_COUNT(ht); if ((argc != 2 && argc != 3) || getParametersArray(ht, argc, argv) == FAILURE) { @@ -738,6 +738,11 @@ if (cursor->query) { efree(cursor->query); } + + quote = query; + while ((quote = strstr(quote, "\\\'")) != NULL) + *quote = '\''; + cursor->query = query; cursor->fetched = 0; if(cursor->params && cursor->nparams > 0){ @@ -925,7 +930,7 @@ pval *argv[2]; oraConnection *conn = NULL; oraCursor *cursor = NULL; - text *query; + text *query, *quote; if (ARG_COUNT(ht) != 2 || getParametersArray(ht, 2, argv) == FAILURE) { WRONG_PARAM_COUNT; @@ -962,8 +967,12 @@ RETURN_FALSE; } cursor->open = 1; - cursor->conn_ptr = conn; - + cursor->conn_ptr = conn; + + quote = query; + while ((quote = strstr(quote, "\\\'")) != NULL) + *quote = '\''; + /* Prepare stmt */ if (oparse(&cursor->cda, query, (sb4) - 1, 1, VERSION_7)){ -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net