Re: $_SERVER['REMOTE_ADDR'] and sql injection
| From: | Andrew Ballard | Date: | Wed, 23 Jun 2010 14:58:04 +0000 |
| Subject: | Re: $_SERVER['REMOTE_ADDR'] and sql injection | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-306371@lists.php.net to get a copy of this message | ||
On Wed, Jun 23, 2010 at 10:39 AM, Ashley Sheridan
<ash@ashleysheridan.co.uk> wrote:
>
> On Wed, 2010-06-23 at 10:35 -0400, Andrew Ballard wrote:
>
> On Wed, Jun 23, 2010 at 6:01 AM, Ashley Sheridan
> <ash@ashleysheridan.co.uk> wrote:
> > That's what I'd use. You may also have to wrap it inside an abs() call
> > to ensure it's a positive number, as some IP addresses equate to
> > negative with ip2long().
>
> NO NO NO NO NO!!!!
>
> <?php
>
> $x = ip2long('192.168.0.1');
> var_dump($x);
> // int(-1062731775)
>
> var_dump(long2ip($x));
> // string(11) "192.168.0.1"
>
> var_dump(long2ip(abs($x)));
> // string(13) "63.87.255.255"
>
> ?>
>
> Andrew
>
> Someone had better tell all the makers of the ip2country databases then, because there's
> not a negative number in sight!
>
> Thanks,
> Ash
> http://www.ashleysheridan.co.uk
>
>
You might choose to store an 8-byte integer rather than a 4-byte
integer to prevent negative numbers, but abs() won't do that. Usually
when I store IPv4 addresses in a database, I store them as BINARY(4)
so that I can compare ranges without worrying about either handling
negative numbers or using 8 bytes of storage to deal with addresses
above 127.255.255.255. I have also seen people present a case for
storing each octet in a separate TINYINT column.
Andrew