How To Makes Sure Nobody Uses Sql Injection In Yii?

Yii 1.1 General Discussion
1

please help… :(

2

You can try it!

http://www.yiiframework.com/doc/guide/1.1/en/topics.security

3

this document does not mention sql injection…

to prevent sql injections you must use value quoting or (event better) named parameters. Default code uses named parameters everywhere, so the only place which may be vulnerable to sql injection is your own code or poor third party libraries.

By named parameters I mean this:




$model = Model::model()->find( array( 'condition'=> 't.param = :pvalue', 'params'=>array( ':pvalue'=>$whatever_needed ) ) );


...


$command = $connection->createCommand( "INSERT INTO tbl_user (username, email) VALUES(:username,:email)" );

$result = $command->execute( array( ':username'=>'aaaa', ':email'=>Yii::app()->request->getPost( 'email', '' ) ) );


etc.

also read about parameters binding: http://www.yiiframework.com/doc/guide/1.1/en/database.dao#binding-parameters

4

I strongly recommend this wonderful wiki article which discusses SQL injections, and many other security related stuff in Yii.

5

This is what you need: http://www.yiiframework.com/doc/guide/1.1/en/database.dao#binding-parameters