Feat: Avoiding SQL injections using prepared statements of MySQLi (Open for contribution)

SaiyamTuteja / Faculty_Evaluation_System

MIT License

32 stars 48 forks source link

Feat: Avoiding SQL injections using prepared statements of MySQLi (Open for contribution) #30

Open aswinikalyan30 opened 6 months ago

aswinikalyan30 commented 6 months ago

Describe the feature

In the current implementation , we are directly passing the POST data with session variables into the query string which can expose the application to SQL injection. Re-factor the SQL statements in admin_class.php file to mitigate this.

Add ScreenShots

Refactor items like these into:

Prepared statements like these:

Record

[X] I agree to follow this project's Code of Conduct
[ ] I'm a GSSOC'24 contributor
[ ] I want to work on this issue

aswinikalyan30 commented 6 months ago

More than 1 can work on this issue and collaborate across files to implement this

anushkasaxena07 commented 6 months ago

@aswinikalyan30 please assign this issue to me....i would love to work on this .

aswinikalyan30 commented 6 months ago

Hey @anushkasaxena07 , there are a lot of queries to be modified and need to ensure everything is working after the changes I'll assign this to you, but will keep it open so that other contributors can work with you

anushkasaxena07 commented 6 months ago

i have to make changes just in admin_class.php file or in others too ? @aswinikalyan30

aswinikalyan30 commented 6 months ago

There are direct SQL queries injection in many files, let this issue be only for the admin_class file. Will open another one for the others

SheetalDawar commented 5 months ago

i would like to work on this project, please assign this to me