C Declaration to PB

[John Thompson]

I'm trying to use a MySQL C declaration in PB, but I'm having problems.
If anyone has the know-how and a minute to help, I'd appreciate it.

The C declaration is:

unsigned long mysql_real_escape_string(MYSQL *mysql, char *to, const char *from, unsigned long length)

Here's an example of its usage:

char query[1000],*end
end = strmov(query,"INSERT INTO test_table values(");
*end++ = '\'';
end += mysql_real_escape_string(&mysql, end,"What's this",11);
*end++ = '\'';
*end++ = ',';
*end++ = '\'';
end += mysql_real_escape_string(&mysql, end,"binary data: \0\r\n",16;
*end++ = '\'';
*end++ = ')';
if (mysql_real_query(&mysql,query,(unsigned int) (end - query)))
{
 fprintf(stderr, "failed to insert row, Error: %s\n",
   mysql_error(&mysql));
}

Or, if there are any MySQL users who do this another way, please
let me know!

Thanks!!

John

------------------
LOCAL MyEMail AS STRING
MyEMail = "jtintel" & CHR$(64) & "gmail" & CHR$(46) & "com"

[Michael Mattias]

>I'm trying to use a MySQL C declaration in PB,

But PB is BASIC, not C!

I think you should search "mysql", message subject, all forums, all dates.

Wouldn't be surprised at all if you found PB headers already done for you.

[John Thompson]

Thanks Michael,

I've been through all of them, I believe. This is a (newer?) function
in the API that I have not seen in any of the existing code available
from this forum. I found a similar (MySQL_Escape_String) function
with VB declarations, but when I tried to use it it failed. I
believe MySQL_Escape_String is deprecated in favor of the new
MySQL_Real_Escape_String so I don't know what the reason is it
didn't work (deprecated or wrong declaration).

Thanks anyways,

John

------------------
LOCAL MyEMail AS STRING
MyEMail = "jtintel" & CHR$(64) & "gmail" & CHR$(46) & "com"

[Michael Mattias]

Well, Ok, if it's not in there, it's not in there.

I'd declare it

DECLARE FUNCTION mysql_real_escape_string (MySql AS mySql, szTo AS ASCIIZ, _ 
    szFrom AS ASCIIZ, BYVAL pData AS BYTE PTR, BYVAL datalength AS LONG) AS LONG

In context, it just looks like how MySql builds an INSERT statement when one or more of the VALUES is so-called BINARY data. Passing a pointer to the data and the length of that data is a pretty common way to do that. Best guess is the function adds the necessary escape characters and the data itself to the query stering.

[John Thompson]

Hey Michael,

Yeah, it is useful for binary values, but also for checking input
from untrusted sources (users on a webpage, application input
boxes, etc.). See this page for more info.

One question though, and I have no knowledge of C so I don't know
if I'm missing something, but your declaration takes five variables
and the C one takes 4. Is there something extra in PB that I need
to provide to this function?

DECLARE FUNCTION mysql_real_escape_string (MySql AS mySql, szTo AS ASCIIZ, _
szFrom AS ASCIIZ, BYVAL pData AS BYTE PTR, BYVAL datalength AS LONG) AS LONG

Thanks!

John


------------------
LOCAL MyEMail AS STRING
MyEMail = "jtintel" & CHR$(64) & "gmail" & CHR$(46) & "com"

[This message has been edited by John Thompson (edited September 05, 2005).]

[John Thompson]

The link above is now working if anyone couldn't access it before.

------------------
LOCAL MyEMail AS STRING
MyEMail = "jtintel" & CHR$(64) & "gmail" & CHR$(46) & "com"

[Michael Mattias]

I'm not a C programmer either. All those params confused me. Try this

DECLARE FUNCTION mysql_real_escape_string (MySql AS mySql, szSqlStmt AS ASCIIZ,_
            BYVAL pData AS BYTE PTR, BYVAL datalength AS LONG) AS LONG

..where szSqlStatement is the statement to which the binary data at address pData, length datalength is to be 'escape-added' to the statment.