Re: [PHP-DEV] Recent PostgreSQL serious security hole

2006-05-30 Thread Christopher Kings-Lynne
Here's a question. The docs for mysql_real_escape_string claim that it checks the magic_quotes_gpc setting and will stripslashes() automatically. However, I see nothing in the code that indicates this. Is it a documentation error? Chris Christopher Kings-Lynne wrote: As a follow up

Re: [PHP-DEV] Recent PostgreSQL serious security hole

2006-05-28 Thread Christopher Kings-Lynne
As a follow up I've attached my initial patch for this. Can people please review? Chris Christopher Kings-Lynne wrote: Hi, I'm starting on a pg_real_escape_string and pg_real_escape_bytea function for PostgreSQL, based on this security release: http://www.postgresql.org/docs/t

[PHP-DEV] Recent PostgreSQL serious security hole

2006-05-26 Thread Christopher Kings-Lynne
Hi, I'm starting on a pg_real_escape_string and pg_real_escape_bytea function for PostgreSQL, based on this security release: http://www.postgresql.org/docs/techdocs.49 Is anyone else working on it, or is it fine that I do it? I'll let you know if it's going to take me too long. Basically

Re: [PHP-DEV] php_pgsql.dll

2005-07-08 Thread Christopher Kings-Lynne
This question should have been posted to php.general or php.install, not internals. Nicholas Telford Christopher Kings-Lynne wrote: No, I just said that the "Collection of PECL modules for PHP 5.0.4" on the downloads page does NOT contain php_pgsql.dll - nor any other db for tha

Re: [PHP-DEV] php_pgsql.dll

2005-07-07 Thread Christopher Kings-Lynne
with the installer. Edin - Original Message - From: "Dan Scott" <[EMAIL PROTECTED]> To: "Christopher Kings-Lynne" <[EMAIL PROTECTED]> Cc: "php-dev" Sent: Thursday, July 07, 2005 12:48 PM Subject: Re: [PHP-DEV] php_pgsql.dll Try http://snaps.php.net/ f

[PHP-DEV] php_pgsql.dll

2005-07-06 Thread Christopher Kings-Lynne
Where do you get php_pgsql.dll for the PHP for windows 5.0.4 installer? I installed the PECL package - no pgsql. I searched the PECL site - no pgsql. What gives? Chris -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] Re: phpPgAdmin

2005-04-10 Thread Christopher Kings-Lynne
Aargh. My mailer must have expanded the alias to the wrong list :( Sorry all. M. Sokolewicz wrote: wwhhhyyy. did you CC internals on this? :| Christopher Kings-Lynne wrote: Hi Plamen, My name is Plamen Petrov and I wanted to help out in developing phpPgAdmin. Currently I don't have

[PHP-DEV] Re: phpPgAdmin

2005-04-10 Thread Christopher Kings-Lynne
Hi Plamen, My name is Plamen Petrov and I wanted to help out in developing phpPgAdmin. Currently I don't have much time to contribute since I am working on a project that takes away my weekends too but in couple of months or something like that I may have some more time. That's ok - when you have t

Re: [PHP-DEV] PDO proposal: add PDOStatement::nextResult() method to support stored procedures

2005-04-09 Thread Christopher Kings-Lynne
BTW, I have now added PDOStatement::nextRowset() documentation to the manual. That's what I get for reading my own (incomplete) documentation. Oh multiple result sets per stored procedure... I'm not sure that is possible in PostgreSQL... -- PHP Internals - PHP Runtime Development Mailing List To

Re: [PHP-DEV] PDO proposal: add PDOStatement::nextResult() method to support stored procedures

2005-04-09 Thread Christopher Kings-Lynne
PDO API. Many databases (Apache Derby, DB2, Microsoft SQL Server, MySQL 5, and PostgreSQL to a certain extent) support stored procedures PostgreSQL to a certain extent, what the...? Anyway, why do stored procs need to be treated differently to normal results? In PostgreSQL they just return result

Re: [PHP-DEV] libpq version

2005-04-06 Thread Christopher Kings-Lynne
OK, I will upgrade the version of libpq on the snaps box. It probably didn't get updated the last time i upgraded to 8.0.0. The thing is the 7.4 version _should_ work just fine... Chris -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] libpq version

2005-04-06 Thread Christopher Kings-Lynne
You're not making much sense here; first you say that you think the errors are because he is not linking against version 8, but then you say that only version 7.4 or higher is required. As in I suspect (1) he's linking against 7.3 or (2) for some reason the libpq 8.0 windows DLL is specifically mi

Re: [PHP-DEV] libpq version

2005-04-05 Thread Christopher Kings-Lynne
I would suggest to fix this, as there are still plenty of people using 7.x... This is only relevant on Windows, autoconf takes care of it on unix platforms. I strongly suspect that he is not in fact linking against libpq version 8. Is ONLY PQprepare and PQsendPrepare missing? What about the re

[PHP-DEV] Re: libpq version

2005-04-05 Thread Christopher Kings-Lynne
Which version of libpq is required to compile the new pgsql prepare/execute commands in php 5.1? I'm getting compilation probles with 8.0.0 client lib where PQprepare() and PQsendPrepare() seem to be missing. You required the libpq from PostgreSQL 7.4... All use of those two functions is protected

Re: [PHP-DEV] PHP 5.1 Beta 1

2005-04-02 Thread Christopher Kings-Lynne
Well if someone can help me get sqlstate working in pdo_pgsql I'd be happy with a release. At the moment it's just silly that it's not done. However, I'm finding the PDO code a bit of a nightmare so I cannot propagate the sqlstates in all cases... Maybe could I send someone my patch so far? A

Re: [PHP-DEV] PHP 5.1 Beta 1

2005-04-02 Thread Christopher Kings-Lynne
I'd like to roll PHP 5.1 Beta 1 very soon. Wez, I've been waiting for PDO in order to get this going. Do you feel it's mature enough or should I hold off some more time? Well if someone can help me get sqlstate working in pdo_pgsql I'd be happy with a release. At the moment it's just silly that

Re: [PHP-DEV] Re: Concern over ext/pgsql API

2005-03-31 Thread Christopher Kings-Lynne
HOWEVER, it is not possible to get a result resource from a failed pg_query! pg_query() returns FALSE on failure, not a result. You could call pg_last_error(), or pg_last_notice(). Although the last one is currently somehow broken: http://bugs.php.net/bug.php?id=32223 Those functions are basicall

[PHP-DEV] Concern over ext/pgsql API

2005-03-30 Thread Christopher Kings-Lynne
Hi, There is a nasty problem with using the new sqlstate codes in the PostgreSQL extension. Say you want to find the sqlstate error code of a query that fails, the function prototype is: $sqlstate = pg_result_error_field($result, PGSQL_DIAG_SQLSTATE); HOWEVER, it is not possible to get a result

Re: [PHP-DEV] Re: [PHP-CVS] cvs: php-src / NEWS /ext/pgsql config.m4 config.w32 pgsql.c /ext/pgsql/tests 08escape.phpt 25async_query_params.phpt

2005-03-29 Thread Christopher Kings-Lynne
If you really don't want to estrndup it for some reason, you are going to need to return a resource and manage that memory yourself through a set of access functions. Well, it would be nice to be able to avoid having to strcpy large binary database objects... I guess I was thinking that there m

Re: [PHP-DEV] Re: [PHP-CVS] cvs: php-src / NEWS /ext/pgsql config.m4 config.w32pgsql.c /ext/pgsql/tests 08escape.phpt 25async_query_params.phpt

2005-03-29 Thread Christopher Kings-Lynne
take a look at the RETURN_STRING[L] macro. the last argument determines whether the string passed to it is duplicated by PHP before returning it to the user. But if you return and duplicate, you have no chance to free() the original string, no? Chris -- PHP Internals - PHP Runtime Developmen

[PHP-DEV] Re: [PHP-CVS] cvs: php-src / NEWS /ext/pgsql config.m4 config.w32 pgsql.c /ext/pgsql/tests 08escape.phpt 25async_query_params.phpt

2005-03-29 Thread Christopher Kings-Lynne
(Reposted to correct list - can someone help here?) I want to return a string allocated by the postgresql library. However, PHP ends up efree()ing it I think, which causes a miscount error. How can I deal with this? What can I do about this? Chris -- PHP Internals - PHP Runtime Development Mai

Re: [PHP-DEV] pdo_pgsql

2005-03-22 Thread Christopher Kings-Lynne
SELECT '?', ? from "?" where ? = $_$?$_$; Oracle has bound variables, but you can't use a bind variable for a table or field in the sql statement. And I'm not using them for pgsql in the statement above. My point was that the parser should ignore '?', "?" and $_$?$_$ which are the three ways of q

Re: [PHP-DEV] pdo_pgsql

2005-03-22 Thread Christopher Kings-Lynne
Wez Furlong wrote: The problem with using $ in the query is that you'd need to \ escape them; remember that PHP uses $ to interpolate its own variables. IMO, adding $ as another way to name parameters is overkill, as we already have :named style. So you are proposing that we rewrite :name and ? pa

Re: [PHP-DEV] pdo_pgsql

2005-03-22 Thread Christopher Kings-Lynne
Depends on how you define "correctly" ;-) Chances are that it will raise an error. I'm not sure if this should really be considered a problem; that's a really obtuse SQL statement. As a non-pgsqler, I have a hard time figuring out where the variables are. Well, anything that's not perfect is a pro

Re: [PHP-DEV] pdo_pgsql

2005-03-22 Thread Christopher Kings-Lynne
Anything beyond this would be an extension to the PDO spec that would have to be implemented within the actual pdo_pgsql driver. Also, I guess any extension to PDO would be silly, as it defeats he point of a standard interface... Chris -- PHP Internals - PHP Runtime Development Mailing List To un

Re: [PHP-DEV] pdo_pgsql

2005-03-22 Thread Christopher Kings-Lynne
Dan On Tue, 22 Mar 2005 22:36:50 +0800, Christopher Kings-Lynne <[EMAIL PROTECTED]> wrote: Most of the PDO interface is supported in pgsql driver. However we do not use native pgsql prepare/execute but PDO's built in emulation for it. If you could look into how could native api be used in

Re: [PHP-DEV] pdo_pgsql

2005-03-22 Thread Christopher Kings-Lynne
Most of the PDO interface is supported in pgsql driver. However we do not use native pgsql prepare/execute but PDO's built in emulation for it. If you could look into how could native api be used in pdo_pgsql that would be great. Ooer. How on earth do you simulate the parameter markers? Are they

[PHP-DEV] pdo_pgsql

2005-03-21 Thread Christopher Kings-Lynne
Hi, If anyone on this list is the maintainer for ext/pdo_pgsql, could they please reply to me? I am wondering how much of the PDO interface pdo_pgsql supports, and where I can add the missing support (eg. SQLSTATE). Chris -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, v

Re: [PHP-DEV] PHP 4 Bug Summary Report

2005-03-21 Thread Christopher Kings-Lynne
I hope it's ok that I just closed 3 identical 'I want prepared queries in ext/pgsql' bugs :D Chris internals@lists.php.net wrote: PHP 4 Bug Database summary - http://bugs.php.net -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] ext/pgsql build broken

2005-03-19 Thread Christopher Kings-Lynne
OK, fixed. Please test it. I'll be out for an hour or two... Christopher Kings-Lynne wrote: No. Here's the whole section from it: #define PG_DIAG_SEVERITY'S' #define PG_DIAG_SQLSTATE'C' #define PG_DIAG_MESSAGE_P

Re: [PHP-DEV] ext/pgsql build broken

2005-03-19 Thread Christopher Kings-Lynne
No. Here's the whole section from it: #define PG_DIAG_SEVERITY'S' #define PG_DIAG_SQLSTATE'C' #define PG_DIAG_MESSAGE_PRIMARY 'M' #define PG_DIAG_MESSAGE_DETAIL 'D' #define PG_DIAG_MESSAGE_HINT'H' #define PG_DI

Re: [PHP-DEV] ext/pgsql build broken

2005-03-19 Thread Christopher Kings-Lynne
Sorry, just woke up... Compile fails now with ext/pgsql after your commits: /usr/src/php5/ext/pgsql/pgsql.c: In function `zm_startup_pgsql': /usr/src/php5/ext/pgsql/pgsql.c:494: error: `PG_DIAG_INTERNAL_POSITION' undeclared (first use in this function) /usr/src/php5/ext/pgsql/pgsql.c:494: erro

Re: [PHP-DEV] Major upgrade to ext/pgsql

2005-03-17 Thread Christopher Kings-Lynne
The patch looks great. Do you have a CVS account? If not, apply for one and I'll set you up with access to ext/pgsql so that you can commit and maintain that patch. Application sent. As you noticed, right now it's a problem. Lately I've been thinking about preparing infrastructure that will a

Re: [PHP-DEV] Major upgrade to ext/pgsql

2005-03-16 Thread Christopher Kings-Lynne
I wouldn't call pgsql support in PHP stone age :) Hmmm, you're obviously not a PostgreSQL developer, and been wondering why 2 year old postgresql technology hasn't been supported yet :D I do think that this would be a very nice addition to php 5.1. A few questions: Why do we need pg_query_params.

Re: [PHP-DEV] Major upgrade to ext/pgsql

2005-03-16 Thread Christopher Kings-Lynne
Why do we need pg_query_params. Isn't prepare/execute enough? pg_execute($conn, $stmt, $params) seem to be already taking care of the parameters passed. (btw. I wouldn't make $conn optional, it makes adding additional parameters later on pain). Oh, if I didn't explain clearly the $stmt parameter

[PHP-DEV] Major upgrade to ext/pgsql

2005-03-15 Thread Christopher Kings-Lynne
Hi, Attached is a patch that brings PostgreSQL support in PHP out of the stone age! It adds a five new functions: * pg_query_params Allows paramaterised queries (ie. no escaping required). This really is just a libpq shortcut for prepare/execute libpq function: PQexecParams * pg_prepare Create

[PHP-DEV] PHP array to char **

2005-03-14 Thread Christopher Kings-Lynne
Hi, I'm working on some improvements to the pgsql extension and I would like to know how to convert a zval* that points to a PHP array to a char** that I can pass to the pgsql API functions. The API function takes const char** so it will not modify the string, but the string must exist for the