|
|
S-220: PHP-Nuke My_eGallery Module 'gid' Parameter Vulnerability
|
|
SQLITE_CREATE_FUNCTION(3) SQLITE_CREATE_FUNCTION(3) sqlite_create_function - Registers a ";regular" User Defined Function for use in SQL statements SYNOPSIS
void sqlite_create_function (resource $dbhandle, string $function_name, callable $callback, [int $num_args = -1]) DESCRIPTION
Object oriented style (method): void SQLiteDatabase::createFunction (string $function_name, callable $callback, [int $num_args = -1]) sqlite_create_function(3) allows you to register a PHP function with SQLite as an UDF (User Defined Function), so that it can be called from within your SQL statements. The UDF can be used in any SQL statement that can call functions, such as SELECT and UPDATE statements and also in triggers. PARAMETERS
o $dbhandle - The SQLite Database resource; returned from sqlite_open(3) when used procedurally. This parameter is not required when using the object-oriented method. o $function_name - The name of the function used in SQL statements. o $callback - Callback function to handle the defined SQL function. Note Callback functions should return a type understood by SQLite (i.e. scalar type). o $num_args - Hint to the SQLite parser if the callback function accepts a predetermined number of arguments. Note Two alternative syntaxes are supported for compatibility with other database extensions (such as MySQL). The preferred form is the first, where the $dbhandle parameter is the first parameter to the function. RETURN VALUES
No value is returned. EXAMPLES
Example #1 sqlite_create_function(3) example <?php function md5_and_reverse($string) { return strrev(md5($string)); } if ($dbhandle = sqlite_open('mysqlitedb', 0666, $sqliteerror)) { sqlite_create_function($dbhandle, 'md5rev', 'md5_and_reverse', 1); $sql = 'SELECT md5rev(filename) FROM files'; $rows = sqlite_array_query($dbhandle, $sql); } else { echo 'Error opening sqlite db: ' . $sqliteerror; exit; } ?> In this example, we have a function that calculates the md5 sum of a string, and then reverses it. When the SQL statement executes, it returns the value of the filename transformed by our function. The data returned in $rows contains the processed result. The beauty of this technique is that you do not need to process the result using a foreach loop after you have queried for the data. PHP registers a special function named php when the database is first opened. The php function can be used to call any PHP function with- out having to register it first. Example #2 Example of using the PHP function <?php $rows = sqlite_array_query($dbhandle, "SELECT php('md5', filename) from files"); ?> This example will call the md5(3) on each filename column in the database and return the result into $rows Note For performance reasons, PHP will not automatically encode/decode binary data passed to and from your UDF's. You need to manually encode/decode the parameters and return values if you need to process binary data in this way. Take a look at sqlite_udf_encode_binary(3) and sqlite_udf_decode_binary(3) for more details. Tip It is not recommended to use UDF's to handle processing of binary data, unless high performance is not a key requirement of your application. Tip You can use sqlite_create_function(3) and sqlite_create_aggregate(3) to override SQLite native SQL functions. SEE ALSO
sqlite_create_aggregate(3). PHP Documentation Group SQLITE_CREATE_FUNCTION(3)
