Warning generated by mysql_real_escape_string

[achimnol]

After changing my blog to 1.9 tree, I see the following warning printed at the bottom of my blog main pages.

Warning: mysql_real_escape_string(): Access denied for user 'www-data'@'localhost' (using password: NO) in /.../blog/framework/data/MySQL/Adapter.php on line 276

The reason is that mysql_real_escape_string() requires explicit database connection BEFORE calling it when $link == null. There are three possible fixes:

1. Use prepared SQL statements only without escaping (pros: safest way, cons: needs to rewrite more than 100 queries used everywhere & MySQLi is required)
2. Fix the order of code to make it to connect to DB first (reference, pros: no tricks, cons: needs to understand workflow in detail)
3. Write our own escape() function (pros: easy to fix, cons: possible security hole unless carefully written)

[inureyes]

We already encapsulate every query via codeball database adapter (located at /framework/data). Therefore the problem is: when the code first calls DBModel::escapeString.

[inureyes]

First escapeString call is from reading pageCache to load blog settings.

[inureyes]

It could be plugin-specific problem. Can you backtrace your escapeString call? Add var_dump(debug_backtrace()); at the below of if(is_null(self::$escapeTag)) { and share us the first call point. :)

[achimnol]

I extracted FILE:FUNC:LINE only because var_dump()-ing produced too much output...

library/model/blog.response.remote.php:escapeString Line 96
library/model/blog.response.remote.php:getRemoteResponses Line 277
library/view/view.php:getTrackbacks Line 186
interface/common/blog/entries.php:getTrackbacksView Line 77
interface/index.php:require Line 108
rewrite.php:include_once Line 11

[inureyes]

Can you check the self::$db value when escapeString is called at first? I would like to know whether DB connection is established when mysql_real_escape_string is called. Theoretically, it should be called after DB is connected (self::$db is not null or false)

[achimnol]

In framework/data/MySQL/adaptor.php DBAdaptor::escapeString(), self::$db is 1 and $link from the arguments is null. (Shouldn't these be same?) This leads to invocation of mysql_real_escape_string().

/home/daybreaker/www/blog/library/model/blog.response.remote.php:escapeString Line 96
/home/daybreaker/www/blog/library/model/blog.response.remote.php:getRemoteResponses Line 277
/home/daybreaker/www/blog/library/view/view.php:getTrackbacks Line 186
/home/daybreaker/www/blog/interface/common/blog/entries.php:getTrackbacksView Line 77
/home/daybreaker/www/blog/interface/index.php:require Line 108
/home/daybreaker/www/blog/rewrite.php:include_once Line 11
self:$db = 1
self:$escapeTag = 
$link ?null 1
/home/daybreaker/www/blog/library/model/blog.response.remote.php:escapeString Line 133
/home/daybreaker/www/blog/library/model/blog.response.remote.php:getRecentRemoteResponses Line 285
/home/daybreaker/www/blog/interface/common/blog/end.php:getRecentTrackbacks Line 77
/home/daybreaker/www/blog/interface/index.php:require Line 109
/home/daybreaker/www/blog/rewrite.php:include_once Line 11
self:$db = 1
self:$escapeTag = real
$link ?null 1

[achimnol]

Another similar issue:

Warning: mysql_query(): Access denied for user 'www-data'@'localhost' (using password: NO) in framework/data/MySQL/Adapter.php on line 245
Warning: mysql_query(): A link to the server could not be established in framework/data/MySQL/Adapter.php on line 245

[achimnol]

When using MySQLi adaptor,

Warning: mysqli::real_escape_string(): Couldn't fetch mysqli in framework/data/MySQLi/Adapter.php on line 265
Warning: mysqli::real_escape_string(): Couldn't fetch mysqli in framework/data/MySQLi/Adapter.php on line 265
Warning: mysqli::real_escape_string(): Couldn't fetch mysqli in framework/data/MySQLi/Adapter.php on line 265
Warning: mysqli::real_escape_string(): Couldn't fetch mysqli in framework/data/MySQLi/Adapter.php on line 265
Warning: mysqli::query(): Couldn't fetch mysqli in framework/data/MySQLi/Adapter.php on line 244