 |
|
 |
Send your sample mysql database also so that I will try because I am new to this area.
s.k. Patel
|
|
|
|
 |
|
 |
i have testing the wrapper.php and make following corrections:
echo ($_POST["mswtype"]);
echo ($_POST["mswdatabase"]);
echo ($_POST["mswstatement"]);
echo ($_POST["mswdata"]);
$type = $_POST["mswtype"];
$statement = $_POST["mswstatement"];
$data = $_POST["mswdata"];
$database = $_POST["mswdatabase"];
$W = new SQLWrapper();
$W->assign("server","user","password",$database,$statement);
$W->performDQL();
class SQLWrapper
{
var $MyServer = "";
var $MyUID = "";
var $MyPWD = "";
var $MyDB = "";
var $Statement = "";
var $Sep = ";";
function assign($server,$uid,$pwd,$sDB,$sql)
{
/* stripslashes for remove escaped chars */
$this->MyServer = stripslashes($server);
$this->MyUID = stripslashes($uid);
$this->MyPWD = stripslashes($pwd);
$this->MyDB = stripslashes($sDB);
$this->Statement = stripslashes($sql);
}
function performDQL()
{
$now = date("Y-m-d H:i:s");
// for debug:
file_put_contents ("wrapperlog.txt","/* $now $REMOTE_ADDR $PHP_AUTH_USER */ use $this->MyDB;\r\n $this->Statement; \r\n", FILE_APPEND | FILE_TEXT );
//
$db = mysql_connect($this->MyServer,$this->MyUID,$this->MyPWD);
mysql_query("SET NAMES 'utf8'");
mysql_select_db($this->MyDB);
$res = mysql_query($this->Statement);
IF (! $res ) { // Errorhandling
$err = mysql_error();
file_put_contents ("wrapperlog.txt","/* $now $REMOTE_ADDR $PHP_AUTH_USER */\r\n $this->MyDB;\r\n $this->Statement; \r\n", FILE_APPEND | FILE_TEXT );
file_put_contents ("wrapperlog.txt","/* Error: $err */\r\n", FILE_APPEND | FILE_TEXT );
} else {
echo ("#begin_result#");
for ($i=0;$iSep);}
}
if (mysql_num_rows($res)>0) {echo (" ");}
$x = 0;
while ($r = mysql_fetch_array($res))
{
$x++;
for ($i=0;$iSep);}
}
if ($x!=mysql_num_rows($res))
{
echo (" ");
}
}
echo ("#end_result#");
}
mysql_close($db);
}
}
?>
|
|
|
|
 |
|
 |
How is security handeled here? Since any sql stmt can be passed ie "DROP DATABASE xyz"
|
|
|
|
 |
|
 |
Interesting question...as you see there's no security yet. So what's possible ?
One is, sure one can give a custom name to wrapper script, so if it's used personally no one knows script url..additional one has to know about this class.
But a look farer it needs:
1. Scalable Ignoring of violent statements at serverside ?
or /or and
2. Asynchronous encryption of submition with private key at serverside and private key at clientside + autocreated, individual 'grant table' for specific users ( userinformation submitted in request)?
What would you do ?
|
|
|
|
 |
|
 |
One possible solution is using a method. (ie web service or REST) where username/pw is submitted, and returning a session key , which is valid for X minutes and/or until user has logged out or session has been inactive for Y minutes.
If a higher level of security is needed: The auth method can return a salt (secret word), and each call must contain a a GUID and the sha1-key of (GUID + salt) in addition to the session key.
All calls should be done ussing HTTPS.
|
|
|
|
 |
|
 |
knowing the script name/ argument structure is easy, since the GET Request is delivered in plain text over the Net, so https is a must.
|
|
|
|
 |
|
 |
Good idea. A webservice without all the overhead. But:
Is it possible to post and get binary data (images) that way, or need I include changes?
|
|
|
|
 |
|
 |
The idea is what counts, thanks. But one has to implement some typecasting at all, such as binary data casting. Let's do it...
|
|
|
|
 |
|
 |
hi,
i use the hexstr function and the mysql unhex to store
best regards
werner
static string hexstr(byte[] inArray)
{
System.Text.StringBuilder sb = new System.Text.StringBuilder();
for (int x = 0; x < inArray.Length; x++)
{
sb.AppendFormat("{0:X2}", inArray[x]);
}
return sb.ToString();
}
static string DateToSql(DateTime dt)
{
string strDateTime = dt.Year.ToString() + "-" +
dt.Month.ToString().PadLeft(2, '0') + "-" +
dt.Day.ToString().PadLeft(2, '0') + " " +
dt.Hour.ToString().PadLeft(2, '0') + ":" +
dt.Minute.ToString().PadLeft(2, '0') + ":" +
dt.Second.ToString().PadLeft(2, '0');
return strDateTime;
}
static string escstr(string s)
{
System.Text.StringBuilder sb = new System.Text.StringBuilder();
for (int i = 0; i < s.Length; i++){
if (s[i] == '\\' || s[i] == '\'' || s[i] == '"')
{
sb.Append('\\');
}
sb.Append(s[i]);
}
return sb.ToString();
}
byte[] readBytes ;
byte[] readBytespng;
byte[] readBytesthn;
strSql = "replace into files set ";
strSql += " fi_host = '" + strfi_host +"'";
strSql += " ,fi_root = '" + strfi_root + "'";
strSql += " ,fi_path = '" + strfi_path + "'";
strSql += " ,fi_name = '" + strfi_name + "'";
strSql += " ,fi_extension = '" + strfi_extension + "'";
strSql += " ,fi_body = unhex('" + hexstr(readBytes) + "')";
strSql += " ,fi_thumbnail = unhex('" + hexstr(readBytesthn) + "')";
strSql += " ,fi_png = unhex('" + hexstr(readBytespng) + "')";
strSql += " ,fi_type = ''";
strSql += " ,fi_text = '" + escstr(strfi_text) + "'";
strSql += " ,fi_size = '" + strfi_size + "'";
strSql += " ,fi_created = '" + strfi_created + "'";
strSql += " ,fi_modified = '" + strfi_modified + "'";
strSql += " ,fi_owner = '" + strfi_owner + "'";
strSql += " ,fi_comment = '" + strfi_comment + "'";
strSql += " ,fi_version = '" + fi_version.ToString() + "'";
strSql += " ,fi_deleted = '" + strfi_deleted + "'";
strSql += " ,fi_uuid = '" + strfi_uuid + "'";
strSql += " ,fi_mac = '" + sMac + "'";
|
|
|
|
 |
|