urgent: scouring SQL log

[sneakyimp]

My brother's hapless employee accidentally overwrote two weeks worth of user signups. His hapless IT guy failed to get backups working each nite before this horrible accident occurred.

Now it's up to me to scour his SQL logs and find the hundreds of users who signed up in the meantime and retrieve their SQL insert and update statements so i can restore their values.

i am writing a script to scan the binary log line by line and then user pattern matching to extract sql queries on the appropriate database.

finding the start of a query is easy...it's always DATABASE_NAME(space)INSERT or UPDATE

finding the end of the query is not so easy. it never seems to be ended by the same character. it's always a series of vowels with an umlaut (ë) or division signs or something folllowed by an STX char (ASCII=2) and then an SOH char (ASCII=1). I'm not sure, but I think there are always 4 of the weird characters and then the STX/SOH combo.

I was wondering if anyone could shed some light on this for me. I have a few burning questions:

1) can i bank on my hunch that there are always 4 of these weird chars?
2) Is there some limited set of those crazy characters or could they be literally any character with or without umlauts?
3) can i do a pattern matching search for the STX/SOH chars?
4) Do i really stand a chance?

Any help would be much appreciated.

[ProudCat]

Did you get answer to your questions? I have similar problem with \0 character.
When I try to use explode('0',$mydata) it convert mydata to an array incorrectly.
I also tried str_replace('0','#') and pre_replace('0) - they both do not work at all.

Do you have any ideas except manual parsing?
Jane

[sneakyimp]

i seem to recall that i used pattern-matching (preg_match). are you trying explode('0', $mydata) or explode("\0", $mydata)?

[ProudCat]

I posted a separate thread about it and got an answer that works.
FYI, $str = preg_split('/\00/', $str);

Jane