java-http请求不适用于长文本

Question

I get the code from the internet and trying to send a large text through http post . I dont know for sure if this code is for http post but i believe so. I have a php page where i get the parameters and add them to the database. When the text is like 5 6 characters the method works fine and updates the database. When i send a message like 300 characters it does not update the database. My message column in database is longtext type. What might be the problem? Thanks in advance.

 public String sendMessage(String  username, String  tousername, String message) throws UnsupportedEncodingException 
{           
    String params = "username="+ URLEncoder.encode(this.username,"UTF-8") +
                    "&password="+ URLEncoder.encode(this.password,"UTF-8") +
                    "&to=" + URLEncoder.encode(tousername,"UTF-8") +
                    "&message="+ URLEncoder.encode(message,"UTF-8") +
                    "&action="  + URLEncoder.encode("sendMessage","UTF-8")+
                    "&";        
    Log.i("PARAMS", params);
    return socketOperator.sendHttpRequest(params);      
}

 public String sendHttpRequest(String params)
{       
    URL url;
    String result = new String();
    try 
    {
        url = new URL(AUTHENTICATION_SERVER_ADDRESS);
        HttpURLConnection connection;
        connection = (HttpURLConnection) url.openConnection();
        connection.setDoOutput(true);

        PrintWriter out = new PrintWriter(connection.getOutputStream());

        out.println(params);
        out.flush();
        out.close();

        BufferedReader in = new BufferedReader(
                new InputStreamReader(
                        connection.getInputStream()));
        String inputLine;

        while ((inputLine = in.readLine()) != null) {
            result = result.concat(inputLine);              
        }
        in.close();         
    } 
    catch (MalformedURLException e) {
        e.printStackTrace();
    } 
    catch (IOException e) {
        e.printStackTrace();
    }           

    if (result.length() == 0) {
        result = HTTP_REQUEST_FAILED;
    }

    return result;


}

php code

case "sendMessage":
if ($userId = authenticateUser($db, $username, $password)) 
    {   
    if (isset($_REQUEST['to']))
    {
         $tousername = $_REQUEST['to']; 
         $message = $_REQUEST['message'];   

         $sqlto = "select Id from  users where username = '".$tousername."' limit 1";



                if ($resultto = $db->query($sqlto))         
                {
                    while ($rowto = $db->fetchObject($resultto))
                    {
                        $uto = $rowto->Id;
                    }
                    $sql22 = "INSERT INTO `messages` (`fromuid`, `touid`, `sentdt`,     `messagetext`) VALUES ('".$userId."', '".$uto."', '".DATE("Y-m-d H:i")."', '".$message."');";                       

                            error_log("$sql22", 3 , "error_log");
                        if ($db->query($sql22)) 
                        {
                                $out = SUCCESSFUL;
                        }               
                        else {
                                $out = FAILED;
                        }                       
                    $resultto = NULL;
                }   

    $sqlto = NULL;
    }
    }
    else
    {
        $out = FAILED;
    }   
break;

echo out;



   class MySQL
{   
    private $dbLink;
    private $dbHost;
    private $dbUsername;
        private $dbPassword;
    private $dbName;
    public  $queryCount;



    function MySQL($dbHost,$dbUsername,$dbPassword,$dbName)
        {
            $this->dbHost = $dbHost;
            $this->dbUsername = $dbUsername;
            $this->dbPassword = $dbPassword;
            $this->dbName = $dbName;    
            $this->queryCount = 0;      
        }
        function __destruct()
        {
            $this->close();
        }
        //connect to database
        private function connect() {    
            $this->dbLink = mysql_connect($this->dbHost, $this->dbUsername, $this->dbPassword);     
            if (!$this->dbLink) {           
                $this->ShowError();
                return false;
            }
            else if (!mysql_select_db($this->dbName,$this->dbLink)) {
                $this->ShowError();
                return false;
            }
            else {
                mysql_query("set names latin5",$this->dbLink);
                return true;
            }
            unset ($this->dbHost, $this->dbUsername, $this->dbPassword, $this->dbName);     
        }   
        /*****************************
         * Method to close connection *
         *****************************/
        function close()
        {
            @mysql_close($this->dbLink);
        }
        /*******************************************
         * Checks for MySQL Errors
         * If error exists show it and return false
         * else return true  
         *******************************************/
        function ShowError()
        {
            $error = mysql_error();
            //echo $error;      
        }   
        /****************************
         * Method to run SQL queries
         ****************************/
        function  query($sql)
        {   
            if (!$this->dbLink) 
                $this->connect();

            if (! $result = mysql_query($sql,$this->dbLink)) {
                $this->ShowError();         
                return false;
            }
            $this->queryCount++;    
            return $result;
        }
        /************************
        * Method to fetch values*
        *************************/
        function fetchObject($result)
        {
            if (!$Object=mysql_fetch_object($result))
            {
                $this->ShowError();
                return false;
            }
            else
            {
                return $Object;
            }
        }
        /*************************
        * Method to number of rows
        **************************/
        function numRows($result)
        {
            if (false === ($num = mysql_num_rows($result))) {
                $this->ShowError();
                return -1;
            }
            return $num;        
        }
        /*******************************
         * Method to safely escape strings
         *********************************/
        function escapeString($string)
        {
            if (get_magic_quotes_gpc()) 
            {
                return $string;
            } 
            else 
            {
                $string = mysql_escape_string($string);
                return $string;
            }
        }

        function free($result)
        {
            if (mysql_free_result($result)) {
                $this->ShowError();
                return false;
            }   
            return true;
        }

        function lastInsertId()
        {
            return mysql_insert_id($this->dbLink);
        }

        function getUniqueField($sql)
        {
            $row = mysql_fetch_row($this->query($sql));

            return $row[0];
        }
        function testconnection() { 
            $this->dbLink = mysql_connect($this->dbHost, $this->dbUsername, $this->dbPassword);     
            if (!$this->dbLink) {           
                $this->ShowError();
                return false;
            }
            else if (!mysql_select_db($this->dbName,$this->dbLink)) {
                $this->ShowError();
                return false;
            }
            else {
                mysql_query("set names latin5",$this->dbLink);
                return true;
            }
            unset ($this->dbHost, $this->dbUsername, $this->dbPassword, $this->dbName);     
        }       
    }

Answer 1

The problem is not on the Java side but on the PHP side.

When you URLEncode a string in POST or GET, the server side decodes the URL encoding and then places the result in its $_REQUEST variable (and $_POST for that matter).

So the URL encoding does not protect you against single quotes in the text. For that, you need to use an escaping command in PHP to make the string safe for insertion into database. The particular command depends on your database. Note that in the class MySQL that you gave, there is an escapeString method. Use that.