RE: [PHP] OO woes

2004-07-12 Thread Dan Joseph
Hi, Doesn't sound like an OO issue, sounds like you're kiling the query with the '. You should go thru and maybe do an str_replace( ', \', $_POST['test'] ) on all your post variables. -Dan Joseph -Original Message- From: Matthew Sims [mailto:[EMAIL PROTECTED] Sent: Monday,

RE: [PHP] OO woes

2004-07-12 Thread Matthew Sims
Hi, Doesn't sound like an OO issue, sounds like you're kiling the query with the '. You should go thru and maybe do an str_replace( ', \', $_POST['test'] ) on all your post variables. -Dan Joseph Ha! That did it. Thanks! --Matthew Sims --http://killermookie.org -Original

Re: [PHP] OO woes

2004-07-12 Thread Keith Greene
$query = 'INSERT into aeMail set test=\''.$_POST[test].'\''; Your quotes look screwy to me. You seem to be missing both trailing single quotes. try this: $query = 'INSERT into aeMail set test=\'''.$_POST[test].'\'''; At 01:07 PM 7/12/2004, Matthew Sims wrote: PHP version 5.0.0RC3 (cgi) (built:

Re: [PHP] OO woes

2004-07-12 Thread Chris
Your problem has nothing to do with the Objects (or really even PHP for that matter). You're not supposed to run mysql_escape_string on an entire query. Here's an example of its usage: $sString = This string contains a single-quote ('); $sQuery = INSERT INTO mytable SET

Re: [PHP] OO woes

2004-07-12 Thread Matthew Sims
Your problem has nothing to do with the Objects (or really even PHP for that matter). You're not supposed to run mysql_escape_string on an entire query. Yup, you are correct, my bad. So I ran my $_POST array into array_map before the injection: $_POST = array_map(mysql_escape_string,$_POST);

Re: [PHP] OO woes

2004-07-12 Thread John W. Holmes
Matthew Sims wrote: Your problem has nothing to do with the Objects (or really even PHP for that matter). You're not supposed to run mysql_escape_string on an entire query. So I ran my $_POST array into array_map before the injection: $_POST = array_map(mysql_escape_string,$_POST); And it all