php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #54437 mysql_real_escape_string don't escape: \x00, \n, \r and \x1a
Submitted: 2011-03-31 22:54 UTC Modified: 2011-04-01 18:31 UTC
From: jose dot nobile at gmail dot com Assigned:
Status: Not a bug Package: MySQL related
PHP Version: 5.3.6 OS: Any
Private report: No CVE-ID: None
 [2011-03-31 22:54 UTC] jose dot nobile at gmail dot com
Description:
------------
mysql_real_escape_string don't escape: \x00, \n, \r and \x1a as is mentioned in 
documentation:

http://co.php.net/manual/es/function.mysql-real-escape-string.php

and \r in a quote string in a insert into query, is a syntax error, I'm handling 
binary data (PDF Files).

Tested on Windows XP SP3 with PHP builds from PHP, and Centos 5.5 with personal 
configure, both using PHP 5.3.6 and in Windows, MySQL Server version is 5.5.8-log 
and Centos is 5.0.77-log


Client API version	mysqlnd 5.0.8-dev - 20102224 - $Revision: 308673 $

Test script:
---------------
$link = @mysql_pconnect("localhost","root","");
if (!$link)
{
	die('Not connected : ' . mysql_error());
}
echo "\\x00, \\n, \\r, \\, ', \" and \\x1a.";
echo "<br />\r\n";
print mysql_escape_string("\x00, \n, \r, \, ', \" and \x1a.");

Expected result:
----------------
\x00, \n, \r, \, ', " and \x1a.

\\x00, \\n, \\r, \\, \', \" and \\x1a.

Actual result:
--------------
\x00, \n, \r, \, ', " and \x1a.

\0, \n, \r, \\, \', \" and \Z.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-04-01 07:52 UTC] dtajchreber@php.net
-Status: Open +Status: Bogus
 [2011-04-01 07:52 UTC] dtajchreber@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php


 [2011-04-01 15:36 UTC] jose dot nobile at gmail dot com
Can you explain, why this function is not working as is documented?

And, What is the correct function, to espace binary data with chars "\r" than to 
have to escape before to send to mysql?
 [2011-04-01 18:31 UTC] dtajchreber@php.net
Those are control characters. Because they've been escaped you're seeing a text 
representation of them instead of 
the literal characters. I don't know why you would expect anything different 
from when you manually escaped them? 

You can escape binary data with with mysql_real_escape_string or change the 
encoding your binary data to base64 for 
example...

[1] http://en.wikipedia.org/wiki/Control_character
[2] http://en.wikipedia.org/wiki/Base64
[3] http://us2.php.net/manual/en/function.base64-encode.php
 
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Tue Jan 31 21:05:54 2023 UTC