How to run a PDO/ODBC/PHP query with double quote in it? -


when run following simple query inside microsoft access: 

select * movie moviename 'batman'

it works.

also using double quotes around string works: 

select * movie moviename "batman"

i have website user can type in any select query php run , returning record results user. use pdo/odbc connect access database. if user types in query 1 works, query 2 fails with:

[microsoft][odbc microsoft access driver] few parameters. expected 1. (sqlexecute[-3010] @ ext\pdo_odbc\odbc_stmt.c:254)

the documentation says quote() function:

"not pdo drivers implement method (notably pdo_odbc). consider using prepared statements instead."

but can't use prepared statement don't know query user type in. use '...' around string , "...".

to reproduce need access (.mdb/.accdb) database @ least 1 table called 'film' , column 'titel'. put records in it. @ least 1 'batman'. use following testscript: 

//also using older access version of database "film.mdb" didn't work //be sure use full/absolute pathname $dbnamefile="c:\\wamp\\www\\elearning2\\databases\\film.accdb"; $username=""; $password=""; $accessdriver="{microsoft access driver (*.mdb, *.accdb)}"; $dbdb = new pdo("odbc:driver=$accessdriver;dbq=$dbnamefile", $username, $password,                  array(pdo::attr_errmode => pdo::errmode_exception));  //testcases, comment 1 //testcase 1: works $sql="select * film titel 'batman'";  //testcase 2: works $sql='select * film titel \'batman\'';  //testcase 3: count field incorrect: -3010 [microsoft][odbc microsoft access driver] few parameters. expected 1. $sql="select * film titel \"batman\"";  //testcase 4: count field incorrect: -3010 [microsoft][odbc microsoft access driver] few parameters. expected 1. $sql='select * film titel "batman"';  //testcase 5: syntax error (missing operator) in query expression 'titel \[batman\]  $sql='select * film titel \"batman\"';  //testcase 6: syntax error (missing operator) in query expression 'titel []batman[] $sql='select * film titel ""batman""';  $result=$dbdb->query($sql); $rows=$result->fetchall(pdo::fetch_assoc);   $result->closecursor();  foreach($rows $row) {   echo $row["titel"]."\n";   echo "<br>"; }  $dbdb=null;

how can escape user given sql query php/pdo/odbc/access? or not possible use "..." string delimiter, despite working in access?

i find error messages testcase 5 , 6 odd. looks double quote changed [ or ]??

i can't use bind parameters, prepared statements or rewrite query because query totally unknown , given user , can contain syntax error(s). can't modify user query , want executed pdo/odbc how?

i use apache 2.4.9 , php 5.5.12 running locally on windows 7 sp1 machine.

i posted official php bug report

here's proof query 1 , 2 both work in access: enter image description here


Comments

Post a Comment

Popular posts from this blog

angularjs - ADAL JS Angular- WebAPI add a new role claim to the token -

i have created angular spa webapi backend using adal js authentication.as there no roles in ad, need manually add role claims in order give users access different api controllers. the roles stored in database. expecting inject claim through call webapi after authentication ad. webapi code might this. identity.addclaim(new claim("role", "user")); var ticket = new authenticationticket(identity, props); var accesstoken = startup.oauthbeareroptions.accesstokenformat.protect(ticket); is possible replace adal idtoken new token? is viable solution or there other better way handle this? as initial token generated azuread, possible edit token add new claim? appreciated. graph api supporting group claims. see here: http://justazure.com/azure-active-directory-part-4-group-claims/ if @ examples on page, users assigned groups , app can check group in claims. in current version of portal, need app manifest , modify it.
Read more

node.js - Using Node without global install -

i'm working on few node & electron (atom shell) projects , i'm curious how them work without user having install node globally. i've seen few applications including node directory in project contains node.exe binary. how go setting node project use binary? edit: thought should add, i've searched everywhere answer this, unrelated results.
Read more

php - CakePHP HttpSockets send array of paramms -

i problem when make request (i can request). $link = 'http://uri/path/?param1=1&sid=2&sid=3&sid=4' $http = $httpsocket = new httpsocket(); $res = $httpsocket->get($link); if check request pr($http); i see : [line] => /url/path/?param1=1&sid%5b0%5d=2&sid%5b1%5d=3&sid%5b2%5d=4 http/1.1 and i'm getting empty response because server doesn't know parameters sid%5b0%5d=2 when try send parameters array : $data = array('param1' => '1', 'sid' => array('2','3', '4')); i see same changes %5b0%5d - additional indexes. how fix it? unfortunately , can not change server side, if send request in browser, i'll normal response in json format. when make request, can parameters this: $param1 = $_get['param1']; $sid= $_get['sid']; tip: use diferente names parameters. have multiples sid. use sid1, sid2, sid3... update: can parameters this:...
Read more