search

AlexDenisov / iActiveRecord

ActiveRecord for iOS without CoreData, only SQLite
http://alexdenisov.github.com/iActiveRecord/
MIT License
354 stars 50 forks source link

SQL Injection #51

Closed paulocoutinhox closed 11 years ago

paulocoutinhox commented 11 years ago

Hi,

After i use it on my projects, users can write a note on his bookmark on my app. The problem is when users type something like:

Text: "a new bookmark" my bookmark

The iActiveRecord doesnt escape charcters. But i thing that the best solution is rewrite the queries using parameters instead of create all the query and bind on hand.

Can you solve it?

AlexDenisov commented 11 years ago

I know about this problem, but it needs a lot of work and changes in core implementation. I can solve it, but cannot give you any promises about when I will fix it.

AlexDenisov commented 11 years ago

Seems that this issue fixed, I will close this one. Thank you :smile: