Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:63932
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 209.85.216.170 cause and error)
Message-ID: <50A67B09.4060808@lerdorf.com>
Date: Fri, 16 Nov 2012 09:42:33 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20121028 Thunderbird/16.0.2
MIME-Version: 1.0
To: Patrick ALLAERT <patrickallaert@php.net>
CC: Adam Harvey <aharvey@php.net>, 
 PHP internals <internals@lists.php.net>
References: <CACwt+JeJ-H0e+MB-d7skTejoksCsHShB7_U8z1ke7EYWZ=-pWw@mail.gmail.com> <50A6691E.2080102@lerdorf.com> <CACwt+JcDLiGyq0jE6BZuxUkXJjU7X3WaOnysJWJ9yyccvtUSWg@mail.gmail.com>
In-Reply-To: <CACwt+JcDLiGyq0jE6BZuxUkXJjU7X3WaOnysJWJ9yyccvtUSWg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: mysql_escape() issue (Was: [PHP-DEV] RFC: ext/mysql
 deprecation)
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 11/16/2012 09:32 AM, Patrick ALLAERT wrote:
> 2012/11/16 Rasmus Lerdorf <rasmus@lerdorf.com>:
>> On 11/16/2012 02:18 AM, Patrick ALLAERT wrote:
>>> In eZ Publish CMS, we have recently removed [1] support for the mysql
>>> handler in favour of the mysqli one and as such, we have no more
>>> mysql_*() functions calls except for the above use case where we rely
>>> on mysql_escape().
>>
>> I suppose you mean mysql_real_escape_string() here. There is no
>> mysql_escape() function and mysql_escape_string() is already marked as
>> deprecated as of 5.3.
>>
>> -Rasmus
> 
> Sorry, I meant mysql_escape_string().
> I missed the fact it was already deprecated and as such, we have an
> issue here in our code base since nor mysql_real_escape_string() nor
> mysqli_real_escape_string() fits our use case as we are using it when
> we have to generate an SQL file with queries to be executed on another
> box. Not having access to a database prevents us to have a link which
> is required by those functions.

But without a link you don't know which charset the db is in and
therefore you can't reliably escape a query. In your case you can do a
custom escape thing based on the fact that you might know the
destination charset, but PHP on its own can't.

-Rasmus