Does Symfony 2 request object protect against sql injection

Question

Does using this class: http://api.symfony.com/2.0/Symfony/Component/HttpFoundation/Request.html

as opposed to $_GET and $_POST project against sql injection.

I mostly use findby and findoneby but I do have a general search that I made that I'm worried about.

I'm using $this->getDoctrine()->getManager()->createQuery("query") for the search.

DonCallisto · Accepted Answer · 2017-11-21 13:56:16Z

1

As long as you use doctrine's built in methods or you write your own DQL statement using placeholders and parameters, you will not running into any risk.

Take a look at this page

In your specific case, as you didn't provide a real example, I cannot evaluate but I think that you are exposing your database to sql-injection. A soution, ad I told you here, is to use query builder along with placeholders and parameters.

edited Nov 21, 2017 at 13:56

user6830821

answered Nov 9, 2014 at 8:01

DonCallisto

30k9 gold badges74 silver badges104 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Does Symfony 2 request object protect against sql injection

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related