将var_export保存到MySql数据库

Question

I have a php script which executes a command on the server for example:

exec('sudo unoconv -f pdf '.$file, $output, $return);

Then I check if the script executed successfully:

if(!$return) { Do something here } else{ $errormsg = var_export($output, true); }

The error message might look something similar to this:

array ( 0 => 'Error: /invalidfileaccess in pdf_process_Encrypt', 1 => 'Operand stack:', 2 => '', 3 => 'Execution stack:', 4 => ' %interp_exit .runexec2 --nostringval-- --nostringval-- --nostringval-- 2 %stopped_push --nostringval-- --nostringval-- --nostringval-- false 1 %stopped_push 1910 1 3 %oparray_pop 1909 1 3 %oparray_pop 1893 1 3 %oparray_pop --nostringval-- --nostringval-- --nostringval-- --nostringval-- false 1 %stopped_push', 5 => 'Dictionary stack:', 6 => ' --dict:1162/1684(ro)(G)-- --dict:1/20(G)-- --dict:82/200(L)-- --dict:82/200(L)-- --dict:109/127(ro)(G)-- --dict:291/300(ro)(G)-- --dict:20/31(L)--', 7 => 'Current allocation mode is local', )

I then attempt to store the error message into my MySql database:

mysqli_query($con, "INSERT INTO incidents (operation, date, error) VALUES ('convert', '$date', '$errormsg')");

The column error is of data type VARCHAR(), when I execute the above query nothing is inserted into the database, if I remove $errormsg from the above command the data is successfully inserted into the database. Which data type should I use for the column so that the error message would be inserted?

Answer 1

The method seems to return a string. This code

<?php

$var = ['test' => 'ja'];
$result = var_export($var, true);
echo gettype($result);

prints "string" to output. So as I understood, this method returns valid PHP-Code as a string.

I would guess, that the problem is not related to this function but to the SQL-Query or code for storing the information.

Update: I saw, that you posted an update. The problem is, that you are neither escaping the string nor using prepared statements. I would recommend to you, that you use prepared statements instead of string interpolation. This is also relevant with regards to security problems.

See mysqli_real_escape_string or even better mysqli_prepare