anti sql-injection in magento

Question

I searched for anti sql-injection code. Folloing code is what i adopted. I want to re-confirm that following php code can prevent sql-injection

$sql_select = "
SELECT
    *
FROM main_tbl
WHERE 
(
  (((main_tbl.from_id = :sender_id) AND (main_tbl.to_id = :to_id)) 
    OR ((main_tbl.to_id = :sender_id) AND (main_tbl.from_id = :to_id)))
  AND
  (main_tbl.last_date > :lasttime)
);
";

$binds = array(
    'sender_id' => $sender_id, 
    'to_id' => $to_id,
    'sender_id' => $sender_id,
    'to_id' => $to_id,
    'lasttime' => $lasttime
);
$resource = Mage::getModel('core/resource');
$read = $resource->getConnection('core_read');
$results = $read->fetchAll($sql_select, $binds);

It won't work as your only end up with 3 items in the array, but 5 bound placeholders. (Presuming PDO emulation mode is off) — Lawrence Cherone
– Lawrence Cherone, Commented Aug 3, 2018 at 6:47
This can be buggy, because i extracted part of source. What about Bind, bind is certainly anti sql-injection code? — Knowledge Drilling
– Knowledge Drilling, Commented Aug 3, 2018 at 6:56
I'm not sure you what you mean.. generally, if you dont know whats going on in background (didnt read the docs then source), the rule of thumb is if you need to use :param's or ? in your SQL statements and pass in arrays to the API, then your most likly "anti sql-injection" safe.. — Lawrence Cherone
– Lawrence Cherone, Commented Aug 3, 2018 at 7:09

Classified · Accepted Answer · 2018-08-03 07:02:42Z

2

Yes, this code doesn't show any vulnerabilities and should be secure. A good rule of thumb is to always validate the user input.

However your code is a bit flawed, but judging from your comment on your question I assume you already know that.

answered Aug 3, 2018 at 7:02

Classified

5601 gold badge7 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

anti sql-injection in magento

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related