[SOLVED] How about SQL Injection

Archives Yii 1.0.x Discussions
1

Hi,

a part of post controller:



$post=new Post;


if(isset($_POST['Post']))


{


  $post->attributes=$_POST['Post'];


  if(isset($_POST['submitPost']) && $post->save())


    $this->redirect(array('show','id'=>$post->id));


}

is it SQL Injection proof?

Second question:



$criteria=new CDbCriteria;


$criteria->params = array(":id"=>1);


$records=fpost::model()->findAll($criteria);

$criteria->params does not work. I get no error, but I should get only one record (with id=1), I get all…

2

Yes. Internally, AR will use prepared statement and bind those input parameters. Also, before saving, you should have a set of rules to validate those parameters.

3

Quote

Yes. Internally, AR will use prepared statement and bind those input parameters.

and when my model is an instance of 'CFormModel' not AR?

4

Then you have neither save() nor SQL. ;)

5

Quote

Then you have neither save() nor SQL. ;)

Let's say I have a code:



$form = new myCFormModel;


if(isset($_POST['myCFormModel']))


{            


  $form->attributes=$_POST['myCFormModel'];


  if($form->validate()){


    $criteria=new CDbCriteria;


    $critera->condition = "id='{$form->searchId}'";


    $myARrecords=myAR::model()->findAll($criteria);          


  }


}

and it isn not SQL Injection proof…

6

That's your responsibility. You should write:



$criteria->condition='id=:id';


$criteria->params=array(':id'=>$form->searchId);
7

Quote

That's your responsibility. You should write: 


$criteria->condition='id=:id';


$criteria->params=array(':id'=>$form->searchId);

Thanks, that works fine!