search

torstenroeder / zefiro

Small Content Management Framework in PHP/MySQL
GNU Lesser General Public License v3.0
0 stars 1 forks source link

Use prepared statements in place of self-made string-concatenation #13

Open Rillke opened 5 years ago

Rillke commented 5 years ago

Please always use prepared statements instead of self-made string-concatenation to guard against SQL injection. Prepared statements are the only easy way to check and prove that no injection is possible.

torstenroeder commented 5 years ago

Ok, I see the point. How can we achieve this? Is this a larger (or complex) issue?

Rillke commented 5 years ago

Ok, I see the point. How can we achieve this? Is this a larger (or complex) issue?

Might not be the case. However, while considering prepared statements, one should also consider a clear separation between the data layer/model and the controller/view functionality.

torstenroeder commented 5 years ago

We should implement that for the new productive version if possible (mid-priority).

torstenroeder commented 5 years ago

Could you make a list of files that still need revision?