note 98079 deleted from sqlite3.escapestring by aharvey
| From: | aharvey@php.net | Date: | Mon, 03 Sep 2012 09:05:33 +0000 |
| Subject: | note 98079 deleted from sqlite3.escapestring by aharvey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-190443@lists.php.net to get a copy of this message | ||
Note Submitter: koalay at gmail dot com
----
I seems that the function only escapes single quote ' and left double quote " untouched.
<?php
$database_filename = "database.db";
$dbhandle = new SQLite3($database_filename, $mode=0666, $sqliteerror);
$escape_result = $dbhandle->escapeString("testing's is \"fun\".");
print "$escape_result\n";
?>
The result would be:
testing''s is "fun".
So, please use single quote to quote text in sqlite query.
<?php
// this should be OK
$sql = sprintf("INSERT INTO table1 (somestr1, somestr2) VALUES ('%s',
'%s')",
$dbhandle->($somestr1), $dbhandle->($somestr1));
$dbhandle->query($sql);
// this would be vulnerable to injection
$sql = sprintf('INSERT INTO table1 (somestr1, somestr2) VALUES ("%s",
"%s")',
$dbhandle->($somestr1), $dbhandle->($somestr1));
$dbhandle->query($sql);
?>