abreksa4 / mysql-escape-string-polyfill

a very insecure mysql_escape_string implementation for a very limited use case

Home Page:https://abreksa4.github.io/mysql-escape-string-polyfill/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

mysql-escape-string-polyfill

Build Status codecov

mysql-escape-string-polyfill is a very insecure mysql_escape_string implementation (PHP 7.1/7.2) for a very limited use case

Usage

  1. Install this package via composer: composer require andrewbreksa/mysql-escape-string-polyfill
  2. Find all the places you use the mysql_* functions, and refactor your code to use PDO

Limitations

  • Uses the following map to replace characters in a string:
    $replacementMap = [
        "\0" => "\\0",
        "\n" => "\\n",
        "\r" => "\\r",
        "\t" => "\\t",
        chr(26) => "\\Z",
        chr(8) => "\\b",
        '"' => '\"',
        "'" => "\'",
        '_' => "\_",
        "%" => "\%",
        '\\' => '\\\\'
    ];
  • Not very comprehensively tested, this will be an ongoing effort as new edge cases are discovered

Hacking on the complex source code

The implementation can be found in functions.php, and you can run tests by executing composer test

About

a very insecure mysql_escape_string implementation for a very limited use case

https://abreksa4.github.io/mysql-escape-string-polyfill/


Languages

Language:PHP 100.0%