Re: [libdbi-users] libdbi and SQL Injection

2014-01-10 Thread Rick Robinson
As you suggested, switch to dbi_conn_query and it took care of the issue. Appreciate the quick responses and suggestions. Ill be spending more time on the manual this week:) Thanks, Rj On Fri, Jan 10, 2014 at 10:23 AM, Markus Hoenicka < markus.hoeni...@mhoenicka.de> wrote: > At 2014-01-10 15:5

Re: [libdbi-users] libdbi and SQL Injection

2014-01-10 Thread Markus Hoenicka
At 2014-01-10 15:56, Rick Robinson was heard to say: > I have tried the following, which I believe is on the right track but the > program crashes as soon as it gets to dbi_conn_quote_string_copy. I try to > use dbi_conn_quote_string_copy to keep the bad string locked down, and then > use d

Re: [libdbi-users] libdbi and SQL Injection

2014-01-10 Thread Rick Robinson
I am pretty sure I am using dbi_conn_queryf correctly, the code below is actually much longer but I have shortened it to just show an example of the issue. I have two column names, name and title, and want to read in two string values using dbi_conn_queryf. I need to lock down the second value bein

Re: [libdbi-users] libdbi and SQL Injection

2014-01-10 Thread Markus Hoenicka
Am 2014-01-10 14:17, schrieb Markus Hoenicka: > if I understand you correctly, you attempt to insert a value containing the > string "%s Saints going down tonight!" using the libdbi function > dbi_conn_queryf(). Thing is, dbi_conn_queryf() is intended to make > dbi_conn_query() behave s

Re: [libdbi-users] libdbi and SQL Injection

2014-01-10 Thread Markus Hoenicka
Am 2014-01-09 18:49, schrieb Rick Robinson: > I am new to both DBs and this library. I am attempting to save a string and > insert it into my MYSQL DB. > > An example of the data being read into the db is here: > > The name is Krolps, and title is everything after it: > Krolps %s Saints

[libdbi-users] libdbi and SQL Injection

2014-01-10 Thread Rick Robinson
I am new to both DBs and this library. I am attempting to save a string and insert it into my MYSQL DB. An example of the data being read into the db is here: The name is Krolps, and title is everything after it: Krolps %s Saints going down tonight! The title entry in the MYSQL DB is turned