Kenn Humborg wrote:
>>Moreover... I'm still not seeing a huge advantage in using automagic ADO
>>parameters... at all really.
>>>>Perhaps you could give some more examples ?
>>> Maybe I want to allow strings in fields to contain "special"
> chars like '"; without having to worry about quoting rules.
I haven't used this ... so... I can't comment on whether it's
> See that line above with the single period? That's the marker for
> end of body text in SMTP. Yet I can still include it in an email
> and it gets through unmodified.
Uh huh, but, I strongly suspect your mail client did something did such that
Didn't terminate the SMTP session...
Isn't it the case that SMTP commands are delimited with \r\n or am I mad ?
Thus if you could 'inject' CRLF.CRLF into your mail client's Data
payload that *would* break the SMTP session
> Similarly, the database should make it easy for me to store the
>> '"; DROP DATABASE blah
>> in a field. Why not? It's just text.
Well, unless you plan to use user input as the criteria of a WHERE
clause... I don't see how *any* INSERT/RETRIEVE operations on *data* in
a *database* can be considered outside the pale !
Aside from the php ADO layer, which I can't and won't comment on since,
I've no experience of it... solutions like the following
Don't seem to be a "Turning test" level difficulty in a non ADO world.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!