search

5CS024-Team1 / asset-tracker-web

Web app for NHS Asset Tracker project
http://mi-linux.wlv.ac.uk/~1700471/asset-tracker-web/
MIT License
3 stars 3 forks source link

PHP Backend Input Sanitizing #9

Open Philwlv opened 4 years ago

Philwlv commented 4 years ago

https://github.com/5CS024-Team1/asset-tracker-web/blob/53b5078c487b3076a96e9ac574b3d85dd631525a/api/user/add/index.php#L11-L17 Believe 'BuidQuery' function will need prepared statements and filtering/sanitizing. @matthewward00 #7

Philwlv commented 4 years ago

I wanted to put this in with #7, You may have to educate me on how to do that lol.

JoshLmao commented 4 years ago

You only need to make one issue which covers the whole problem which you already did but it's not a problem. Rather than having millions of issues with the same thing just make one and use it. We'll use this one for now.

Don't worry about assigning people either. Usually us dev's do that 😉

JoshLmao commented 4 years ago

If you find any more examples where sanitizing needs to be done, put them in here please

Philwlv commented 4 years ago

sure, how do I do that? I tried to add this to the previous one. You can tell im getting into it now, assigning people and adding labels, Whooo. 😆 🤦‍♂

I wont do this every day 😆 I'll do a few and come back a few days later. I don't wona be that annoying, only a little bit annoying 😄

JoshLmao commented 4 years ago

Good on you! Haha

Do the selecting an area of code like normal, but instead of clicking "Reference in New Issue" click the "Copy Permalink" one. Then go to comment like normal and paste the link

Philwlv commented 4 years ago

https://github.com/5CS024-Team1/asset-tracker-web/blob/c31e5f84a95e2fa794384614aff35c6bd8b34de1/api/assets/deallocate/index.php#L27-L31 This input $id will need filtering and the query will need putting in a prepared statement.