Re: Sanitizing potential MySQL strings with no database connection

Jim Lucas wrote: > Dotan Cohen wrote: >> 2009/10/19 Kim Madsen <php.net@emax.dk>: >>> Dotan Cohen wrote on 2009-10-18 21:21: >>> >>>> I thought that one could not test if a database connection is >>>> established or not, this is the most relevant thing that I found while >>>> googling that: >>>> http://bugs.php.net/bug.php?id=29645 >>> from >>> http://www.php.net/manual/en/function.mysql-connect.php >>> >>> $link = mysql_connect('localhost', 'mysql_user', >>> 'mysql_password'); >>> if (!$link) { >>> die('Could not connect: ' . mysql_error()); >>> } >>> >>> So just test if $link is available >>> >> I need to know if there is _any_ connection available, not a specific >> connection. In one script it may be $link but in another $connection. >> > > Dotan, > > You are making this thing harder then it has to be. > > All you need is to replicate the escaping of the same characters that > mysql_real_escape_string() escapes. Simply do that. They are listed on the > functions manual page on php.net > > http://php.net/mysql_real_escape_string > > Here is a function that I mocked up really quick. > > I have no idea if it will work, but it is a start down the right road to solve > your problem(s)... > > <?php > > function clean_string($input) { > > /** > * Character to escape... > * \x0 \n \r \ ' " \x1a > **/ > > $patterns = array( "\x0", "\n", "\r", "\\", > "'", "\"", "\x1a"); > $replace = array( '\\\x0', '\n', '\r', '\\\\', > '\\\'', '\\"', '\\\x1a'); > return str_replace($patterns, $replace, $input); > } > > ?> > > Jim Lucas > So, actually taking a minute to read up on addcslashes(), it is a rather handy little function. Taking the list of characters that mysql_real_escape_string() says it escapes: http://us3.php.net/mysql_real_escape_string Which it lists: \x00, \n, \r, \, ', " and \x1a \0 = \x0 \10 = \n \13 = \r \92 = \ \44 = ' \34 = " \26 = \x1a You could do something like this. function cleaner($input) { return addcslashes($input, "\0\10\13\92\44\34\26"); } Maybe this will help... Jim