dudapiotr / ZfTable

*Not supported*ZfTable 3.1. Awesome ZF2 table / grid (and much much more) generator with huge possibilities of decorating and conditioning. Integrated with DataTables, Doctrine 2, Bootstrap 2.0 and 3.0.
http://dudapiotrek.laohost.net/
MIT License
75 stars 59 forks source link

Security issue on ZFTable - Input validation #15

Closed julillosamaral closed 10 years ago

julillosamaral commented 10 years ago

In ZfTable/src/ZfTable/Controller/TableController.php input data from the user is not validated, that can cause XSS attacks and helps on the creation of sql injection attacks.

There should be and Input Filter to validate the data from the user. I know that the users of ZfTable should be the ones that validate the data, but I think that to avoid problems the example should have the Input Filter.

As well as the sql injection problem, if I have some time I will fix it.