[Patch] mysql_set_charset for mysql ext

From: Date: Wed, 18 Oct 2006 12:47:03 +0000
Subject: [Patch] mysql_set_charset for mysql ext
Groups: php.internals 
Request: Send a blank email to internals+get-26079@lists.php.net to get a copy of this message
Hi, Attached is a patch that adds a mysql_set_charset function to the MySQL extension, its for all branches at the moment and ideally it should be applied to all. Before anyone starts advocating that everyone upgrades to PHP5 and use MySQLi its not always realistic for some and other people are just stubborn. The reason for the patch is that the mysql_set_character_set function provided by the MySQL API sets the internal MySQL character set for the connection which is referenced by functions such as mysql_real_escape_string. Without the ability to change the character set on the connection users use the SET NAMES 'charset' query which lacks the ability to update the internal character set. In certain cases this can lead to an SQL Injection. I'll simply refer everyone to a blog entry by Ilia http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html I'd like this consider this a security issue and get it applied to the PHP 4 branch even though active development is more or less finished. Cheers, Scott

« previous php.internals (#26079) next »