On Thu, September 28, 2006 10:06 am, tedd wrote:
> In one of my snip-its, namely:
>
> http://xn--ovg.com/pdf
>
> I was generating a pdf document after the user filled in a form. I
> had been cleaning the user input by using  --
>
> $name = mysql_real_escape_string($name);
>
> -- even though I wasn't using MySQL (the code was a cut-paste from
> some other code I had).

But you *WERE* using MySQL!

> However, everything worked!
>
> But, a couple of days ago it suddenly stopped working. Now, I get the
> following error:
>
> Warning: mysql_real_escape_string(): Access denied for user
> 'nobody'@'localhost' (using password: NO) in ...

One of two things happened.

Some auto-connect script is no longer running, or the 'nobody' user in
MySQL got nuked.

Cuz you used to be connected to MySQL, and it was using MySQL database
information to do the escaping.

> When I comment-out the offending statement, it runs. I replaced the
> statement, but wonder what happened -- when did using
> mysql_real_escape_string() require a password?

mysql_real_escape_string talks back to MySQL to ask it what character
encoding you are using, so it knows how to correctly escape
multi-byte/unicode/funky characters for MySQL usage.

Take out the "_real" bit, and it's doing a "fake" version that ignores
multibyte/unicode/funky characters.

So, short term, just delete '_real' from your function call, and it
will act exactly like before, except with the caveat that any
unicode/multibyte/funky characters may not be escaped the same way as
they were.

> What's up with that? Any ideas as to what happened?

One also has to ask WHY you would use MySQL's escaping for data that's
not going into MySQL.

That's almost certainly "wrong"

Though I confess, I'm sometimes at a loss how to properly escape
certain data for certain situations...

Here's an example:
Take the Subject of an email.

Sure, I've sanitized it to be sure there are no newlines for header
injection.

But now how do I properly escape it to be sure it's a kosher email
subject?

Where's the PHP function smtp_escape()?

I'm just passing it on from one user to another.  I don't want to
munge it, nor make any assumptions about its format.  It's just "data"
to me.

But to SMTP, there are bound to be all kinds of "rules" about it that
I have no desire, much less time, to research, code, and test in as
thorough a fashion as I should to be Professional.

And every developer who sends an email with PHP needs this, right?

So of the myriad PHP functions available, which one is the right one
to escape an email Subject.

I'm *NOT* asking for an answer to this specific question about email
Subjects!

I'm looking for a guide, a chart, a grid, an organized systemic
documentation of what data should be escaped how as it travels through
the "glue" that is PHP...

-- 
Like Music?
http://l-i-e.com/artists.htm

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to