Re: [PHP-DEV] Mysql Patch for Multi-User Safety

2002-04-03 Thread chand
At 17:34 03/04/2002 +0300, Zeev Suraski wrote: >Problems I could spot: hey Zeev, nice to talk to you again :) >- You use (*z_user)->value.str.val without making sure that z_user is of >type string. You must have convert_to_string_ex(z_user) first (line 159 >of the patch) >- You don't allocat

Re: [PHP-DEV] Mysql Patch for Multi-User Safety

2002-04-03 Thread Zeev Suraski
Problems I could spot: - You use (*z_user)->value.str.val without making sure that z_user is of type string. You must have convert_to_string_ex(z_user) first (line 159 of the patch) - You don't allocate room for the NULL terminator in tmp_filename (line 188 of the patch) Do you know where it

Re: [PHP-DEV] Mysql Patch for Multi-User Safety

2002-04-03 Thread chand
Thanks Here is the patch to the ext/mysql/php_mysql.c file It looks a bit messy and there might be some stuff you don't get right away. Basically here"s what it does. Mysql_connect gets a user, host and password (set to empty). We don't really care about those values. Actually, i get the path

Re: [PHP-DEV] Mysql Patch for Multi-User Safety

2002-04-03 Thread Markus Fischer
I would suggest simple post an url with the path against whatever version and people feeling attracted will contact you (even I might take a peek ;-) - Markus On Wed, Apr 03, 2002 at 11:50:36AM +0200, Chand wrote : > hi everyone, > > I'm working on a hosting platform with a lar

[PHP-DEV] Mysql Patch for Multi-User Safety

2002-04-03 Thread Chand
hi everyone, I'm working on a hosting platform with a large number of users, and we need to ensure safety for our users considering the mysql Connection. Using a password is not good enough cause if someone succeeds in getting the source code of someone, he will get the password and then will