[Patch] mysql_set_charset for mysql ext
| From: | Scott MacVicar | Date: | Wed, 18 Oct 2006 12:47:03 +0000 |
| Subject: | [Patch] mysql_set_charset for mysql ext | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-26079@lists.php.net to get a copy of this message | ||
Hi,
Attached is a patch that adds a mysql_set_charset function to the MySQL
extension, its for all branches at the moment and ideally it should be
applied to all.
Before anyone starts advocating that everyone upgrades to PHP5 and use
MySQLi its not always realistic for some and other people are just stubborn.
The reason for the patch is that the mysql_set_character_set function
provided by the MySQL API sets the internal MySQL character set for the
connection which is referenced by functions such as
mysql_real_escape_string.
Without the ability to change the character set on the connection users
use the SET NAMES 'charset' query which lacks the ability to update the
internal character set.
In certain cases this can lead to an SQL Injection. I'll simply refer
everyone to a blog entry by Ilia
http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html
I'd like this consider this a security issue and get it applied to the
PHP 4 branch even though active development is more or less finished.
Cheers,
Scott