Avoiding SQL injections

Yii 2.0 General Discussions
1

silly question about avoiding SQL injections, I think my app is doing okie but just checking to make sure it is what I think it is :)

Have a button , on click will open a modal that has a comment.

User enter comment, then click submit.

Behind the scene, an ajax post request send out to register the comment.

Here is my backend





$item = Item::findOne($id);

if ($item === NULL) return 0;


$item->comment = Yii::$app->request->post('comment');

$item->save();

if the bad guys try to SQL injection, am I safe from the wrath of my boss ?

2

Make proper validation rule for ‘comment’ and you are good to go.

3

here is my rule, is it good enough ?




    public function rules()

    {

        return [

            [['project_id', 'name', 'status'], 'required'],

            [['comment'], 'string', 'max' => 1024],

        ];

    }
4

You are not save here from XSS attacks. Consider using HTMLPurifier filter on this attribute as well.

5

I just want to make sure HTMLPunifier must be used only for inserting and updating the database?

6

Yes, you don’t want to use it every time you render view because it slows the process. Use it once, save result.

7

or limit html tags needed for commentand strip the rest!