|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2005-06-03 16:06 UTC] blockcipher at yahoo dot com
Description:
------------
It appears that I found an interesting interaction between the simple_xml library and the mysqli_bind_param function. The values contained within an XML tag are returned as simple_xml object, not strings (which is what I inferred from the Zend tutorial.) This had an adverse side-effect when combined with the mysqli_bind_param function. Please note that this may affect other functions/libraries as well.
The steps are as follows:
1. Copy the value of an XML element into a variable.
2. Use the element in a prepared mysqli statement, binding it to the statement as a string.
3. Run the query.
4. Repeat steps 2 and 3, possibly with a different query.
After the bind or perhaps after I was done with the query, the actual data was changed from a simple_xml object to a very odd looking string. This would crash the apache web server approximately 80-90% of the time when accessed.
Original variable data:
["username"]=>
object(SimpleXMLElement)#3 (1) {
[0]=>
string(4) "test"
}
Modified variable data:
["username"]=>
string(64) "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 "
Reproduce code:
---------------
No code provided since it is being developed for the company I work for.
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Fri Apr 19 22:01:28 2024 UTC |
Here's a quick test case based on the problem. It demonstrates the changing of the data type from an object to a string, but not the crash. <?php $xmltext = "<?xml version='1.0'?><body><user>test</user></body>"; $xmlObj = simplexml_load_string($xmltext); $tempArray['username'] = $xmlObj->user; $dbh = new mysqli('localhost','username','password','mysql'); $stmt = $dbh->prepare('select host from user where user = ? LIMIT 1'); print "Before: "; var_dump($tempArray); print "<br/><br/>Result: "; $stmt->bind_param('s', $tempArray['username']); $stmt->execute(); $stmt->bind_result($temp); $stmt->fetch(); $stmt->close; print "$temp<br/><br/>After: "; var_dump($tempArray); $dbh->close; ?>