Everything
php
Learn Community Releases The PHP Project
Home » Project » Newsgroups » php.internals » [Patch] mysql_set_charset for mysql ext »

[Patch] mysql_set_charset for mysql ext

php.internals

Scott MacVicar

19 years ago
Hi, Attached is a patch that adds a mysql_set_charset function to the MySQL extension, its for all branches at the moment and ideally it should be applied to all. Before anyone starts advocating that everyone upgrades to PHP5 and use MySQLi its not always realistic for some and other people are just stubborn. The reason for the patch is that the mysql_set_character_set function provided by the MySQL API sets the internal MySQL character set for the connection which is referenced by functions such as mysql_real_escape_string. Without the ability to change the character set on the connection users use the SET NAMES 'charset' query which lacks the ability to update the internal character set. In certain cases this can lead to an SQL Injection. I'll simply refer everyone to a blog entry by Ilia http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html I'd like this consider this a security issue and get it applied to the PHP 4 branch even though active development is more or less finished. Cheers, Scott

Scott MacVicar

19 years ago
This is a gentle nudge, there was no interest since this was posted 2 months ago, we had a client who get exploited recently because of this issue. We use mysqli where appropriate but sometimes its not available because hosts don't know any better. Since there are no plans to deprecate the mysql extension any time soon we at least need the ability to protect ourselves. Patches are again PHP 4_4, 5_2 and HEAD. Scott Scott MacVicar wrote:

Olivier Hill

19 years ago
Hello Scott, I did something similar a while ago. You can see [1] why this will not be included in PHP4, as it is considered a new feature. Regards, Olivier [1] http://marc.theaimsgroup.com/?t=115220027800004&r=1&w=2 On 1/24/07, Scott MacVicar <scottmacvicar@ntlworld.com> wrote:

Luca Longinotti

19 years ago
> On 1/24/07, Scott MacVicar <scottmacvicar@ntlworld.com> wrote: >> This is a gentle nudge, there was no interest since this was posted 2 >> months ago, we had a client who get exploited recently because of this >> issue. We use mysqli where appropriate but sometimes its not available >> because hosts don't know any better. >> >> Since there are no plans to deprecate the mysql extension any time soon >> we at least need the ability to protect ourselves. Patches are again PHP >> 4_4, 5_2 and HEAD.
Just for the records, maybe someone will find all this useful (lots of users on Gentoo do ;) ), I've made something similar which will soon be part of the Gentoo PHP packages, because we have lots of users and situations where it's needed to be able to define the mysql connection charset. I'll only link the mysql ext patch for 4.4.4, but on the site you can also find the ones for pdo_mysql and mysqli for PHP 5.2 if needed. Basically just a new ini-entry, PHP_INI_ALL so you can just do ini_set() in your scripts, and define the connection charset for MySQL. Here it is: https://overlays.gentoo.org/proj/php/browser/patches/php-patches/4.4.4/4.4.4/php4.4.4-mysql-charsetphpini.patch Have fun. ;)
-- Best regards, Luca Longinotti aka CHTEKK LongiTEKK Networks Admin: chtekk@longitekk.com Gentoo Dev: chtekk@gentoo.org SysCP Dev: chtekk@syscp.org TILUG Supporter: chtekk@tilug.ch

Scott MacVicar

19 years ago
I'm surprised I didn't find this last October when I posted the first round. Unfortunately most system administrators realise mysql isn't enabled by default with PHP 5 and then just enable mysql alone ignoreing mysqli. Since this could be considered a security fix I'm hoping Derick will make an exception and just patch this for 4.4.5. But even if he doesn't, maybe Ilia will apply the patches to 5_2 and HEAD. Unless there is an easy way to mass educated people about MySQLi. Regards, Scott Olivier Hill wrote:

Ilia A.

19 years ago
The patch will need to wait for 5.2.2, it is too late for it to be accepted into 5.2.1 tree. Ilia

Scott MacVicar

19 years ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Pretty sure the patches should still apply, I can respin them if needed. Scott Ilia Alshanetsky wrote:
> The patch will need to wait for 5.2.2, it is too late for it to be > accepted into 5.2.1 tree. > > Ilia
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFy0BiSLD/pRzIjPIRCI5fAKCaTOvCC4W3jr68x9fv7W4nw1kL4ACfeMeh mwOXYGjaLXWHfHLymKYop9o= =45n2 -----END PGP SIGNATURE-----

Scott MacVicar

19 years ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Appears it didn't apply to HEAD, here is a new patch that stops the character set being changed if Unicode.semantics = On plus it uses the new parameter parsing API. Scott Scott MacVicar wrote:
> Pretty sure the patches should still apply, I can respin them if needed. > > Scott > > Ilia Alshanetsky wrote: >> The patch will need to wait for 5.2.2, it is too late for it to be >> accepted into 5.2.1 tree. > >> Ilia
- ------------------------------------------------------------------------ Index: ext/mysql/php_mysql.c =================================================================== RCS file: /repository/php-src/ext/mysql/php_mysql.c,v retrieving revision 1.226 diff -u -r1.226 php_mysql.c - --- ext/mysql/php_mysql.c 8 Oct 2006 13:34:22 -0000 1.226 +++ ext/mysql/php_mysql.c 18 Oct 2006 12:09:40 -0000 @@ -94,6 +94,10 @@ #define MYSQL_HAS_YEAR #endif +#if (MYSQL_VERSION_ID > 40112 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID > 50005 +#define MYSQL_HAS_SET_CHARSET +#endif + #define MYSQL_ASSOC 1<<0 #define MYSQL_NUM 1<<1 #define MYSQL_BOTH (MYSQL_ASSOC|MYSQL_NUM) @@ -166,6 +170,9 @@ PHP_FE(mysql_thread_id, NULL) PHP_FE(mysql_client_encoding, NULL) PHP_FE(mysql_ping, NULL) +#ifdef MYSQL_HAS_SET_CHARSET + PHP_FE(mysql_set_charset, NULL) +#endif #ifdef HAVE_GETINFO_FUNCS PHP_FE(mysql_get_client_info, NULL) PHP_FE(mysql_get_host_info, NULL) @@ -1119,6 +1126,48 @@ /* }}} */ #endif +#ifdef MYSQL_HAS_SET_CHARSET +/* {{{ proto bool mysql_set_charset(string csname [, int link_identifier]) + sets client character set */ +PHP_FUNCTION(mysql_set_charset) +{ + zval **cs_name, **mysql_link; + int id; + php_mysql_conn *mysql; + + switch(ZEND_NUM_ARGS()) { + case 1: + if (zend_get_parameters_ex(1, &cs_name)==FAILURE) { + RETURN_FALSE; + } + id = php_mysql_get_default_link(INTERNAL_FUNCTION_PARAM_PASSTHRU); + CHECK_LINK(id); + break; + case 2: + if (zend_get_parameters_ex(2, &cs_name, &mysql_link)==FAILURE) { + RETURN_FALSE; + } + id = -1; + break; + default: + WRONG_PARAM_COUNT; + break; + } + + + ZEND_FETCH_RESOURCE2(mysql, php_mysql_conn *, mysql_link, id, "MySQL-Link", le_link, le_plink); + + convert_to_string_ex(cs_name); + + if (!mysql_set_character_set(&mysql->conn, Z_STRVAL_PP(cs_name))) { + RETURN_TRUE; + } else { + RETURN_FALSE; + } +} +/* }}} */ +#endif + #ifndef NETWARE /* The below two functions not supported on NetWare */ #if MYSQL_VERSION_ID < 40000 /* {{{ proto bool mysql_create_db(string database_name [, int link_identifier]) Index: ext/mysql/php_mysql.h =================================================================== RCS file: /repository/php-src/ext/mysql/php_mysql.h,v retrieving revision 1.38 diff -u -r1.38 php_mysql.h - --- ext/mysql/php_mysql.h 1 Jan 2006 13:09:52 -0000 1.38 +++ ext/mysql/php_mysql.h 18 Oct 2006 12:10:02 -0000 @@ -91,6 +91,9 @@ PHP_FUNCTION(mysql_thread_id); PHP_FUNCTION(mysql_client_encoding); PHP_FUNCTION(mysql_ping); +#if (MYSQL_VERSION_ID > 40112 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID > 50005 +PHP_FUNCTION(mysql_set_charset); +#endif ZEND_BEGIN_MODULE_GLOBALS(mysql) long default_link; - ------------------------------------------------------------------------ Index: ext/mysql/php_mysql.c =================================================================== RCS file: /repository/php-src/ext/mysql/php_mysql.c,v retrieving revision 1.213.2.6.2.5 diff -u -r1.213.2.6.2.5 php_mysql.c - --- ext/mysql/php_mysql.c 2 Aug 2006 10:04:11 -0000 1.213.2.6.2.5 +++ ext/mysql/php_mysql.c 18 Oct 2006 12:05:41 -0000 @@ -101,6 +101,10 @@ #define MYSQL_HAS_YEAR #endif +#if (MYSQL_VERSION_ID > 40112 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID > 50005 +#define MYSQL_HAS_SET_CHARSET +#endif + #define MYSQL_ASSOC 1<<0 #define MYSQL_NUM 1<<1 #define MYSQL_BOTH (MYSQL_ASSOC|MYSQL_NUM) @@ -173,6 +177,9 @@ PHP_FE(mysql_thread_id, NULL) PHP_FE(mysql_client_encoding, NULL) PHP_FE(mysql_ping, NULL) +#ifdef MYSQL_HAS_SET_CHARSET + PHP_FE(mysql_set_charset, NULL) +#endif #ifdef HAVE_GETINFO_FUNCS PHP_FE(mysql_get_client_info, NULL) PHP_FE(mysql_get_host_info, NULL) @@ -1126,6 +1133,48 @@ /* }}} */ #endif +#ifdef MYSQL_HAS_SET_CHARSET +/* {{{ proto bool mysql_set_charset(string csname [, int link_identifier]) + sets client character set */ +PHP_FUNCTION(mysql_set_charset) +{ + zval **cs_name, **mysql_link; + int id; + php_mysql_conn *mysql; + + switch(ZEND_NUM_ARGS()) { + case 1: + if (zend_get_parameters_ex(1, &cs_name)==FAILURE) { + RETURN_FALSE; + } + id = php_mysql_get_default_link(INTERNAL_FUNCTION_PARAM_PASSTHRU); + CHECK_LINK(id); + break; + case 2: + if (zend_get_parameters_ex(2, &cs_name, &mysql_link)==FAILURE) { + RETURN_FALSE; + } + id = -1; + break; + default: + WRONG_PARAM_COUNT; + break; + } + + + ZEND_FETCH_RESOURCE2(mysql, php_mysql_conn *, mysql_link, id, "MySQL-Link", le_link, le_plink); + + convert_to_string_ex(cs_name); + + if (!mysql_set_character_set(&mysql->conn, Z_STRVAL_PP(cs_name))) { + RETURN_TRUE; + } else { + RETURN_FALSE; + } +} +/* }}} */ +#endif + #ifndef NETWARE /* The below two functions not supported on NetWare */ #if MYSQL_VERSION_ID < 40000 /* {{{ proto bool mysql_create_db(string database_name [, int link_identifier]) Index: ext/mysql/php_mysql.h =================================================================== RCS file: /repository/php-src/ext/mysql/php_mysql.h,v retrieving revision 1.37.2.1 diff -u -r1.37.2.1 php_mysql.h - --- ext/mysql/php_mysql.h 1 Jan 2006 12:50:09 -0000 1.37.2.1 +++ ext/mysql/php_mysql.h 18 Oct 2006 12:02:50 -0000 @@ -91,6 +91,9 @@ PHP_FUNCTION(mysql_thread_id); PHP_FUNCTION(mysql_client_encoding); PHP_FUNCTION(mysql_ping); +#if (MYSQL_VERSION_ID > 40112 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID > 50005 +PHP_FUNCTION(mysql_set_charset); +#endif ZEND_BEGIN_MODULE_GLOBALS(mysql) long default_link; - ------------------------------------------------------------------------ Index: ext/mysql/php_mysql.c =================================================================== RCS file: /repository/php-src/ext/mysql/php_mysql.c,v retrieving revision 1.174.2.29.2.2 diff -u -r1.174.2.29.2.2 php_mysql.c - --- ext/mysql/php_mysql.c 1 Jan 2006 13:46:55 -0000 1.174.2.29.2.2 +++ ext/mysql/php_mysql.c 18 Oct 2006 11:54:02 -0000 @@ -93,6 +93,10 @@ #define MYSQL_HAS_YEAR #endif +#if (MYSQL_VERSION_ID > 40112 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID > 50005 +#define MYSQL_HAS_SET_CHARSET +#endif + #define MYSQL_ASSOC 1<<0 #define MYSQL_NUM 1<<1 #define MYSQL_BOTH (MYSQL_ASSOC|MYSQL_NUM) @@ -162,6 +166,9 @@ PHP_FE(mysql_thread_id, NULL) PHP_FE(mysql_client_encoding, NULL) PHP_FE(mysql_ping, NULL) +#ifdef MYSQL_HAS_SET_CHARSET + PHP_FE(mysql_set_charset, NULL) +#endif #ifdef HAVE_GETINFO_FUNCS PHP_FE(mysql_get_client_info, NULL) PHP_FE(mysql_get_host_info, NULL) @@ -1123,6 +1130,48 @@ /* }}} */ #endif +#ifdef MYSQL_HAS_SET_CHARSET +/* {{{ proto bool mysql_set_charset(string csname [, int link_identifier]) + sets client character set */ +PHP_FUNCTION(mysql_set_charset) +{ + zval **cs_name, **mysql_link; + int id; + php_mysql_conn *mysql; + + switch(ZEND_NUM_ARGS()) { + case 1: + if (zend_get_parameters_ex(1, &cs_name)==FAILURE) { + RETURN_FALSE; + } + id = php_mysql_get_default_link(INTERNAL_FUNCTION_PARAM_PASSTHRU); + CHECK_LINK(id); + break; + case 2: + if (zend_get_parameters_ex(2, &cs_name, &mysql_link)==FAILURE) { + RETURN_FALSE; + } + id = -1; + break; + default: + WRONG_PARAM_COUNT; + break; + } + + + ZEND_FETCH_RESOURCE2(mysql, php_mysql_conn *, mysql_link, id, "MySQL-Link", le_link, le_plink); + + convert_to_string_ex(cs_name); + + if (!mysql_set_character_set(&mysql->conn, Z_STRVAL_PP(cs_name))) { + RETURN_TRUE; + } else { + RETURN_FALSE; + } +} +/* }}} */ +#endif + #ifndef NETWARE /* The below two functions not supported on NetWare */ #if MYSQL_VERSION_ID < 40000 /* {{{ proto bool mysql_create_db(string database_name [, int link_identifier]) Index: ext/mysql/php_mysql.h =================================================================== RCS file: /repository/php-src/ext/mysql/php_mysql.h,v retrieving revision 1.33.2.2.4.1 diff -u -r1.33.2.2.4.1 php_mysql.h - --- ext/mysql/php_mysql.h 1 Jan 2006 13:46:55 -0000 1.33.2.2.4.1 +++ ext/mysql/php_mysql.h 18 Oct 2006 11:41:37 -0000 @@ -91,6 +91,9 @@ PHP_FUNCTION(mysql_thread_id); PHP_FUNCTION(mysql_client_encoding); PHP_FUNCTION(mysql_ping); +#if (MYSQL_VERSION_ID > 40112 && MYSQL_VERSION_ID < 50000) || MYSQL_VERSION_ID > 50005 +PHP_FUNCTION(mysql_set_charset); +#endif ZEND_BEGIN_MODULE_GLOBALS(mysql) long default_link; -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFy0efSLD/pRzIjPIRCBmxAJ9PIQ0JtagoncPZ9rONuINAphpNtQCdFXyy HLv5Ak8iQTnC7PMVjKh77qs= =cGWc -----END PGP SIGNATURE-----