I
I
Ivan Melnikov2018-04-07 07:10:51
MySQL
Ivan Melnikov, 2018-04-07 07:10:51

Can MySQL 5.7 accept raw VARCHAR variables (raw strings) into procedures and INSERT queries?

The fact is that sometimes an external application writes lines in the VARCHAR field that end with a backslash, and because of this, a MySQL syntax error occurs. For example, there is no access to the application and there is no possibility in principle to correct the code on its side. Maybe MySQL has some mode in which string variables are interpreted by MySQL as raw (backslash is interpreted as a single simple character, not as the beginning of an escape sequence)?
insert into table_name(name) value('ivan\');

Answer the question

In order to leave comments, you need to log in

2 answer(s)
L
Lazy @BojackHorseman MySQL, 2018-04-07
@immelnikoff

NO_BACKSLASH_ESCAPES MODE

A
alexalexes, 2018-04-07
@alexalexes

The query string during SQL processing by the interpreter will already be considered by the SQL syntactic apparatus, it is no longer possible to distinguish what they really meant when they substituted the parameters.
Preprocessing such a string with regular expressions, although it can be useful for individual test cases, will not save you from sql injections.
The developer of an external application should be severely punished for making a request like this:
And his application should be excluded from production, as containing a vulnerability that allows attacks with sql injections, before a fix of such a plan is made in all cases (!!!) where the application contacts the DBMS, and not just in this query:

$sql = "insert into table_name(name) value(:param1)";  //текст запроса с метками для вставки параметров;
$prep_sql = $sqlconnect->prepare($sql); //подготовка SQL-запроса, фактически, синтаксический разбор и выявление меток, куда вставлять параметры, проверка ошибок;
$prep_sql->bindParam('param1', $str_param, STRING_TYPE); //связываем параметры с метками в запросе, проверяем тип входного параметра;
$prep_sql->execute(); //выполняем запрос

PS: The last example is written in pseudocode, but the message should be clear.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question