#30274 [NEW]: Error in SQL injection example in manual page for mysql_real_escape_string()

From: troels at arvin dot dk Operating system: PHP version: Irrelevant PHP Bug Type: Documentation problem Bug description: Error in SQL injection example in manual page for mysql_real_escape_string() Description: ------------ The manual page for mysql_real_escape_string() has a section on the danger of SQL injection; that's nice. However, the example used to illustrate the danger is wrong and misleading, as far as I can see. The page states ... // We didn't check $_POST['password'], it could be anything the user wanted! For example: $_POST['username'] = 'aidan'; $_POST['password'] = "' OR 1=1"; ... However, setting $_POST['password'] to ' OR 1=1 will result in a query like this, which isn't very dangerous because it's a syntax error: SELECT * FROM users WHERE name='aidan' AND password='' OR 1=1' A better example of a dangerous value of $_POST['password'] would be: ' OR ''=' because it would result in this query: SELECT * FROM users WHERE name='aidan' AND password='' OR ''='' -- Edit bug report at http://bugs.php.net/?id=30274&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=30274&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=30274&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=30274&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=30274&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=30274&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=30274&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=30274&r=needscript Try newer version: http://bugs.php.net/fix.php?id=30274&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=30274&r=support Expected behavior: http://bugs.php.net/fix.php?id=30274&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=30274&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=30274&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=30274&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=30274&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=30274&r=dst IIS Stability: http://bugs.php.net/fix.php?id=30274&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=30274&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=30274&r=float MySQL Configuration Error: http://bugs.php.net/fix.php?id=30274&r=mysqlcfg