Storing PHP snippets in MySQL

Question

I am storing PHP snippets in a MySQL database, I am using mysql_real_escape_string and all is well unless there is a & in the php code and then I get a MySQL error. Is there another why I should try and store this information?

Thanks

It's because values are not quoted in query, read this: stackoverflow.com/questions/6198104/… — user680786
– user680786, Commented Jun 7, 2011 at 10:18
@Andre Backlund and how will you implement full text search after that? It's just useless overhead in this case. — user680786
– user680786, Commented Jun 7, 2011 at 10:20

remi bourgarel · Accepted Answer · 2011-06-07 13:37:57Z

3

@Peter : unless you're building a website for helping developers, you have no reason to put php code into your database, it's a warning : this is gonna be a big nightmare to maintain/debug. Can't you link your pages to some parameters and then in your code use these parameters to build each request ? it may seems a simple design solution at the beginning "how god I can do whatever I want in all my pages" but it might be the worse you're taking on your poject.

I don't know how to say this but you should really try to consider an other solution. And i'm not speaing about security : if you have an SQL Injection the guy can execute SQL AND php so he can really take all your system/server down, or even attack bigger site with yours (and then you'll be responsible).

I'm really surprised everyone is fine with it.

answered Jun 7, 2011 at 13:37

remi bourgarel

9,4494 gold badges46 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

CristiC · Accepted Answer · 2011-06-07 10:20:24Z

0

Use base64_encode when you save snippet into the database and base64_decode when you retreive it.

answered Jun 7, 2011 at 10:20

CristiC

22.7k13 gold badges62 silver badges89 bronze badges

8 Comments

user680786 Over a year ago

Don't do it, because search in DB will be impossible.

J.C. Inacio Over a year ago

upvoted answer. the OP wants to store code in DB, and base64 encoding is a proper solution. Also, searching the DB won't be impossible, just searching the actual code (why would that be needed anyway?)

user680786 Over a year ago

He can store code in DB without stupid encodings! Pluses of base64 here: none; minuses: search will be disabled, overhead to encode/decode.

Peter Over a year ago

I just tried base64_encode but mysql still only stored up to the & is the problem maybe passing the & via post?

CristiC Over a year ago

@Peter: Post your solution to the problem here as a new answer, and accept it.

|

ben · Accepted Answer · 2011-06-17 03:03:19Z

First, I am going to go on record and say I wholeheartedly agree with remi bourgarel. This is likely a bad idea.

But, from a technical standpoint here's how I'd do this IF I NEEDED TO:

$php_code = '
    <?php
        $var = "this is a string";
        $var = strtoupper($var);
        echo $var;
    ?>
';
$php_code = bin2hex($php_code);
$db->query("INSERT INTO php_code_snips (text_code) VALUES(x'{$php_code}')");

bin2hex will transform the string $php_code from a binary string to a hex string, and the x'{$php_code}' tells mysql to expect a hex string.

This means the string is stored as a string in the DB, and is fully searchable. But, since all chars are encoded as hex during the INSERT the special chars won't cause a problem.

Documentation:

bin2hex

Mysql Hex Values

Collectives™ on Stack Overflow

Storing PHP snippets in MySQL

3 Answers 3

Comments

8 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

8 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related