diff --git a/reference/mysql/functions/mysql-real-escape-string.xml b/reference/mysql/functions/mysql-real-escape-string.xml index 308d4764cd..588b838429 100644 --- a/reference/mysql/functions/mysql-real-escape-string.xml +++ b/reference/mysql/functions/mysql-real-escape-string.xml @@ -44,14 +44,11 @@ Security: the default character set - Always set your character set at the server level, or with mysql_set_charset. - - - mysql_real_escape_string will take into account the character set - if it is set by either the MySQL Server (e.g., via its default-character-set directive) - or from mysql_set_charset. But, it will not use the character set that is set with - an SQL query, like as a SET CHARACTER SET ... or SET NAMES ... query - with mysql_query. + The character set must be set either at the server level, or with + the API function mysql_set_charset for it to affect + mysql_real_escape_string. See the concepts section + on character sets for + more information. diff --git a/reference/mysql/functions/mysql-set-charset.xml b/reference/mysql/functions/mysql-set-charset.xml index c2c57fa52c..f112f484d4 100644 --- a/reference/mysql/functions/mysql-set-charset.xml +++ b/reference/mysql/functions/mysql-set-charset.xml @@ -62,8 +62,9 @@ This is the preferred way to change the charset. Using - mysql_query to execute SET NAMES .. - is not recommended. + mysql_query to set it (such as SET NAMES utf8) + is not recommended. See the MySQL character set concepts + section for more information. diff --git a/reference/mysqli/mysqli/real-escape-string.xml b/reference/mysqli/mysqli/real-escape-string.xml index 3c5f229d4e..6e7e47e8f0 100644 --- a/reference/mysqli/mysqli/real-escape-string.xml +++ b/reference/mysqli/mysqli/real-escape-string.xml @@ -32,14 +32,11 @@ Security: the default character set - Always set your character set at the server level, or with mysqli_set_charset. - - - mysqli_real_escape_string will take into account the character set - if it is set by either the MySQL Server (e.g., via its default-character-set directive) - or from mysqli_set_charset. But, it will not use the character set that is set with - an SQL query, like as a SET CHARACTER SET ... or SET NAMES ... query - with mysqli_query. + The character set must be set either at the server level, or with + the API function mysqli_set_charset for it to affect + mysqli_real_escape_string. See the concepts section + on character sets for + more information. diff --git a/reference/mysqli/mysqli/set-charset.xml b/reference/mysqli/mysqli/set-charset.xml index ec6b74d81b..ea74cdf26d 100644 --- a/reference/mysqli/mysqli/set-charset.xml +++ b/reference/mysqli/mysqli/set-charset.xml @@ -61,8 +61,9 @@ This is the preferred way to change the charset. Using - mysqli::query to execute SET NAMES .. - is not recommended. + mysqli_query to set it (such as SET NAMES utf8) + is not recommended. See the MySQL character set concepts + section for more information. diff --git a/reference/mysqlinfo/concepts.xml b/reference/mysqlinfo/concepts.xml index aa0bb58e43..468472f760 100644 --- a/reference/mysqlinfo/concepts.xml +++ b/reference/mysqlinfo/concepts.xml @@ -11,7 +11,7 @@ Queries are using the buffered mode by default. This means that query results are - immediately transfered from the MySQL Server to PHP in is then kept in the memory + immediately transferred from the MySQL Server to PHP in is then kept in the memory of the PHP process. This allows additional operations like counting the number of rows, and moving (seeking) the current result pointer. It also allows issuing further queries on the same connection while working on the result set. @@ -19,7 +19,7 @@ quite a lot memory. The memory will be kept occupied till all references to the result set are unset or the result set was explicitly freed, which will automatically happen during request end the latest. The terminology "store result" is also used - for uffered mode, as the whole result set is stored at once. + for buffered mode, as the whole result set is stored at once. @@ -114,4 +114,111 @@ if ($uresult) { +
+ Character sets + + + Ideally a proper character set will be set at the server level, and doing this is described + within the Character Set Configuration + section of the MySQL Server manual. Alternatively, each MySQL API offers a method to set + the character set at runtime. + + + + The character set and character escaping + + The character set should be understood and defined, as it has an affect on every + action, and includes security implications. For example, the escaping mechanism + (e.g., mysqli_real_escape_string for mysqli, mysql_real_escape_string + for mysql, and PDO::quote for PDO_MySQL) will adhere to + this setting. It is important to realize that these functions will not use the character + set that is defined with a query, so for example the following will not have an effect + on them: + + + + + Problems with setting the character set with SQL + +real_escape_string(); +$mysqli->query("SET NAMES utf8"); + +// Will not affect $mysqli->real_escape_string(); +$mysqli->query("SET CHARACTER SET utf8"); + +// But, this will affect $mysqli->real_escape_string(); +$mysqli->set_charset('utf8')) { + +?> +]]> + + + + + Below are examples that demonstrate how to properly alter the character set at runtime + using each each API. + + + + Setting the character set example: mysqli + +set_charset('utf8')) { + printf("Error loading character set utf8: %s\n", $mysqli->error); +} else { + printf("Current character set: %s\n", $mysqli->character_set_name()); +} + +print_r( $mysqli->get_charset() ); + +?> +]]> + + + + + Setting the character set example: <link linkend="ref.pdo-mysql.connection">pdo_mysql</link> + + Note: This only works as of PHP 5.3.6. + + + +]]> + + + + + Setting the character set example: mysql + + +]]> + + +
+ diff --git a/reference/pdo/pdo/quote.xml b/reference/pdo/pdo/quote.xml index 877a3deea9..ad4e99050a 100644 --- a/reference/pdo/pdo/quote.xml +++ b/reference/pdo/pdo/quote.xml @@ -34,6 +34,15 @@ Not all PDO drivers implement this method (notably PDO_ODBC). Consider using prepared statements instead. + + Security: the default character set + + The character set must be set either on the server level, or within the + database connection itself (depending on the driver) for it to affect + PDO::quote. See the driver-specific + documentation for more information. + + &reftitle.parameters; diff --git a/reference/pdo_mysql/reference.xml b/reference/pdo_mysql/reference.xml index 6a0d7606f0..49076f54ff 100644 --- a/reference/pdo_mysql/reference.xml +++ b/reference/pdo_mysql/reference.xml @@ -90,7 +90,8 @@ charset - The character set. + The character set. See the character set + concepts documentation for more information. Prior to PHP 5.3.6, this element was silently ignored. The same