search

mikelbring / Mongor

Laravel MongoDB Package
22 stars 2 forks source link

Mongodb is vulnerable to SQL injection in PHP #1

Open jeroengerits opened 12 years ago

jeroengerits commented 12 years ago

Checkout; http://www.idontplaydarts.com/2010/07/mongodb-is-vulnerable-to-sql-injection-in-php-at-least/.. Should be a fairly simple fix.

mikelbring commented 12 years ago

I remember reading about this. I probably won't do any updates to Mongor from here on out, Laravel is going to be getting core MongoDB ORM support in the near future. Thanks!

jeroengerits commented 12 years ago

Thanks for the response... Where is a more detailed roadmap? Because http://laravel.com/roadmap says nothing about mongo support, or am i missing something? And btw, thanks for mongor.

mikelbring commented 12 years ago

Checkout: http://forums.laravel.com/viewtopic.php?id=417

mikelbring commented 12 years ago

I just turned Mongor into a Eloquent-like ORM under the development branch, so I was thinking about this issue. I don't know if it's a good idea for me to force a string on the values because the developer building the application might not want a string. They might want another MongoID or an array. I am going to leave it up to them to force the right data until I can come up with a better way to do it and not limit the developer. Any ideas?

tobsn commented 12 years ago

why don't you include it as default option to mysql? with eloquent support. so people can just chose if its mysql or mongodb and use the same code... or at least similar code.