Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:109218
Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
In-Reply-To: <B6DFDAD5-87A1-4BB5-8B61-497B72162B57@craigfrancis.co.uk>
Date: Sun, 22 Mar 2020 20:04:58 -0400
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <9AD96E46-8379-45C0-8912-2CA062702999@newclarity.net>
References: <B6DFDAD5-87A1-4BB5-8B61-497B72162B57@craigfrancis.co.uk>
To: Craig Francis <craig@craigfrancis.co.uk>
Subject: Re: [RFC] is_literal()
From: mike@newclarity.net (Mike Schinkel)

> On Mar 22, 2020, at 7:14 PM, Craig Francis <craig@craigfrancis.co.uk> =
wrote:
>=20
> On Sun, 22 Mar 2020 at 19:11, Mike Schinkel <mike@newclarity.net> =
wrote:
>> [...] hash out potential solutions on the list rather than propose a =
specific one in advance.
>=20
> As to your idea of a "safe" MySQL class, fortunately mysqli already =
stops multiple queries, so a SELECT cannot have an =
UPDATE/DELETE/TRUNCATE appended on to the end, but it can still do =
things like UNION another SELECT query, so the original query returns =
nothing, then the attackers query gets appended, potentially allowing =
them to extract everything from the database.

To follow up, a "safe" MySQL class *could* disallow UNION then, no?

In addition, it could possible have flags for every type of query and =
require you set on only the aspects you need.  Unions, Updates, Deletes, =
Truncates, Joins, Where, etc. much like firewalls start will all ports =
closed.

Just spitballing, anyway.

-Mike=20=