From: Justin Clift <justin@postgresql.org>
To: Nigel J. Andrews <nandrews@investsystems.co.uk>
Cc: pgsql-general@postgresql.org
Cc: pgsql-interfaces@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
Date: Sat, 25 Jan 2003 02:44:17 +1030
Message-ID: <3E316659.6030909@postgresql.org> (raw)
In-Reply-To: <Pine.LNX.4.21.0301241529130.28504-100000@ponder.fairway2k.co.uk>
References: <Pine.LNX.4.21.0301241529130.28504-100000@ponder.fairway2k.co.uk>
Nigel J. Andrews wrote:
> Has anyone seen/used this:
>
> http://www.zend.com/codex.php?CID=324
>
> It looks fairly inoccuous. It also claims to not load an entire dataset into
> memory, i.e. uses cursors but I don't see where they're used, unless its
> inherent in the PHP Pg interface.
>
> One thing that always gets me is why people think quoting the ' in a string is
> a security feature when they don't allow for someone giving \' in the
> string. On the other hand I'm never sure how to protect against such 'odd
> number of escapes' attacks. Anyone got any clues? Does PQescape do it?
If it's any help, and approach that I feel is safe is to use the PHP
functions rawurlencode() on all data as soon as it hits the page, then
use that encoded data everywhere in the PHP code (including for storage
in the database), and use rawurldecode() if/when it needs to be spat out
to a browser.
The only real disadvantage is that column widths for data storage need
to be wider, but for databases without huge resource requirements it's
not real noticeable, and the data is pretty safe in encoded form.
:-)
Regards and best wishes,
Justin Clift
> --
> Nigel Andrews
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/users-lounge/docs/faq.html
--
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: justin@postgresql.org, nandrews@investsystems.co.uk, pgsql-general@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
In-Reply-To: <3E316659.6030909@postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox