search

mavinoo / laravelBatch

insert batch and update batch in laravel
MIT License
564 stars 118 forks source link

How about binding parameters? #109

Closed sasha172017 closed 4 months ago

sasha172017 commented 4 months ago

How about binding parameters? It makes sql injection now. It is dangerous.

mavinoo commented 4 months ago

Yes, using bound parameters to prevent SQL injection is crucial. By using bound parameters, input data is properly filtered and sanitized, and if necessary, translated. Without using bound parameters, the system is vulnerable and at risk from a security standpoint. It's always better to ensure that input data is properly filtered and sanitized and to use bound parameters. However, in this package, the mysql_escape method is used to prevent at least some malicious inputs.

https://github.com/mavinoo/laravelBatch/blob/d931f44316ee35747933b339b7cc9b96a162f6be/src/Common/Common.php#L13