# PHP 4.3.3RC3 Released - Thread: https://externals.io/message/3812 - Original archive: https://news-web.php.net/php.internals/3812 - Started by Ilia Alshanetsky on 2003-08-07T18:47:03+00:00 - Messages: 10 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #3812 — Ilia Alshanetsky — 2003-08-07T18:47:03+00:00 URL: https://externals.io/message/3812#3812 PHP 4.3.3RC3 was just released, hopefully this will be the final release candidate prior to the final release. Please test this release as much possible so that any new/critical bugs maybe uncovered and resolved before the final. If you do find such bugs (hopefully you won't) be sure to label them as RC3 bugs. I would like to ask that all developers refrain from making commits to the 4_3 tree until 4.3.3 final is released, unless a patch addresses a critical issue. Critical issues are defined as the following: 1) Security Fixes 2) Fixes for bugs introduced in 4.3.3X releases 3) Fixes for bugs that break backwards compatibility with older versions. Ilia --- ## #3900 — Derick Rethans — 2003-08-14T07:32:56+00:00 URL: https://externals.io/message/3812#3900 · In reply to: #3899 > What about hacking somehow the sqlite library to disallow chained queries > (or at least do it optionally)? > > This behavior is *huge* security hole, allow to the cracker drop ur database > using simple select where query. How is this a security hole? regards, Derick -- "Interpreting what the GPL actually means is a job best left to those that read the future by examining animal entrails." ------------------------------------------------------------------------- Derick Rethans http://derickrethans.nl/ International PHP Magazine http://php-mag.net/ --- ## #3899 — moshe doron — 2003-08-14T08:26:24+00:00 URL: https://externals.io/message/3812#3899 · In reply to: #3812 "Ilia Alshanetsky" wrote in message news:<200308071447.03285.ilia@prohost.org>... > I would like to ask that all developers refrain from making commits to > the 4_3 tree until 4.3.3 final is released, unless a patch addresses a > critical issue. Critical issues are defined as the following: > 1) Security Fixes What about hacking somehow the sqlite library to disallow chained queries (or at least do it optionally)? This behavior is *huge* security hole, allow to the cracker drop ur database using simple select where query. moshe --- ## #3915 — Derick Rethans — 2003-08-14T08:31:44+00:00 URL: https://externals.io/message/3812#3915 > > "Marcus BöRger" wrote in message > > […] > > that's the point. if the cracker can change only the end of the query, it's > not so usefull for him (he can maximum get other id) but if he can chain > totally new query, he may or may no bother changing your sql statements.... But it's a *user* problem (the developer), not a PHP problem. PHP should not break nice functionality in an extension (such as chaining queries) because of people too lazy to verify user input. Derick -- "Interpreting what the GPL actually means is a job best left to those that read the future by examining animal entrails." ------------------------------------------------------------------------- Derick Rethans http://derickrethans.nl/ International PHP Magazine http://php-mag.net/ --- ## #3901 — moshe doron — 2003-08-14T08:41:16+00:00 URL: https://externals.io/message/3812#3901 · In reply to: #3900 "Derick Rethans" wrote in message news:Pine.LNX.4.53.0308140932320.12247@jdi.jdimedia.nl... > > > > […] queries > > […] database > > […] > > How is this a security hole? http://www.phpbuilder.com/mail/php-developer-list/2003022/0062.php moshe --- ## #3916 — Wez Furlong — 2003-08-14T08:45:03+00:00 URL: https://externals.io/message/3812#3916 · In reply to: #3915 +1. This is no bug in PHP, it is not a security flaw in PHP; it is a problem in your code. PHP shouldn't police your lax security because you can't be bothered with it. Can we drop this thread now? :-) --Wez. > > > […] > > But it's a *user* problem (the developer), not a PHP problem. PHP should > not break nice functionality in an extension (such as chaining queries) > because of people too lazy to verify user input. --- ## #3922 — Ard Biesheuvel — 2003-08-14T09:31:14+00:00 URL: https://externals.io/message/3812#3922 · In reply to: #3899 > What about hacking somehow the sqlite library to disallow chained queries > (or at least do it optionally)? If you are unable or unwilling to verify the safety of your input, use a database that supports params + binding (like Firebird :-)) Any input obtained from the client should be considered unsafe (== tainted in Perl) and should be checked for correctness first. In the described case, casting the value to a number if it's expected to be numerical or putting quotes around it if it's expected to be a string value will solve your problem. Disallowing chained queries will prevent *every* developer from ever using it. Ard --- ## #3924 — Hartmut Holzgraefe — 2003-08-14T09:42:43+00:00 URL: https://externals.io/message/3812#3924 · In reply to: #3922 Ard Biesheuvel wrote: > Disallowing chained > queries will prevent *every* developer from ever using it. thats why i suggested earlier to maybe make it a runtime configurable feature that defaults to 'off' -- Hartmut Holzgraefe First of all this discussion bares to relevance to the 4.3.3 release as sqlite > is NOT part of this release. Secondly this is just plain silly. PHP is not > and is not responsible for validating input. If the user chooses not to and > consequently leaves their scripts vulnreable to SQL injection it is their > fault and their fault alone. > Ability to chain queries is an extremely useful feature that most database > systems support (even MySQL as of version 4.0). To cripple or disable such > functionality would be absolute idiocy not to mention break backwards > compatibility to older versions where this was possible. Adding more run-time > directives (as suggested by Hartmut Holzgraefe ) is a bad idea as it makes > writing portable code extremely difficult as each system may have a > drastically different behavior due to an ini option. > > Ilia --- ## #3934 — Ilia Alshanetsky — 2003-08-14T15:07:02+00:00 URL: https://externals.io/message/3812#3934 · In reply to: #3899 First of all this discussion bares to relevance to the 4.3.3 release as sqlite is NOT part of this release. Secondly this is just plain silly. PHP is not and is not responsible for validating input. If the user chooses not to and consequently leaves their scripts vulnreable to SQL injection it is their fault and their fault alone. Ability to chain queries is an extremely useful feature that most database systems support (even MySQL as of version 4.0). To cripple or disable such functionality would be absolute idiocy not to mention break backwards compatibility to older versions where this was possible. Adding more run-time directives (as suggested by Hartmut Holzgraefe ) is a bad idea as it makes writing portable code extremely difficult as each system may have a drastically different behavior due to an ini option. Ilia