search

gilbitron / Arrest-MySQL

A "plug-n-play" RESTful API for your MySQL database.
131 stars 219 forks source link

Arrest-MySQL does not escape requests #16

Open joeinnes opened 9 years ago

joeinnes commented 9 years ago

I'm looking at using Arrest-MySQL in a project, but it fails when I try and post data into a column with a hyphen in the name. The data passed to it contains a hyphen too. I have done quite a bit of testing, and it looks like the issue is that Arrest doesn't escape the input at all, and this breaks it. I have no idea how to PHP, but would love to use Arrest. Does anyone have any suggestions?

joeinnes commented 9 years ago

OK, fixed that issue, now I have a new one:

$this->db->select('*') ->from($table) ->where($col, $search) ->order_by($this->_get('order_by'), $this->_get('order')) ->limit(intval($this->_get('limit')), intval($this->_get('offset'))) ->query();

only returns one row. I've broken it down to

$this->db->select('*') ->from('table') ->where('column', 'search') ->query();

(with hardcoded values for testing), and it still only returns one row, even though the corresponding SQL query returns 4. Any ideas?