ZEND_DB_TABLE_ABSTRACT methods SQL INJECTION

Question

Is it possible for to sql inject a ZEND_DB_TABLE_ABSTRACT method?

like for example

 $this->insert();

edit for a more clearer explanation

Post values are :

'username' = 'admin';

'password' = '1;Drop table users;'

Here is the insert statement in the controller:

public function InsertAction() {
    $postValues =   $this->_request->getPost();
    $usersTable = new Application_Models_DbTable_Users();
    $username = $postValues['username'];
    $password = $postValues['password'];
    $data = array('username'=>$username,'password'=>$password);
    $users->insert($data);
}

can you be little more clear with your code and explanation? — Sam Arul Raj T
– Sam Arul Raj T, Commented Feb 21, 2012 at 6:02
if you create your own model class that "extends Zend_Db_Table_Abstract" , you can add any methods you want — max4ever
– max4ever, Commented Feb 21, 2012 at 8:44

Community · Accepted Answer · 2017-05-23 11:56:41Z

2

Yes, it is possible, but in the usual uses of insert() it's not probable. Unless you are using Zend_Db_Expr, you should be safe, because insert() uses prepared statements.

See this post from Bill Karwin for other methods and details.

edited May 23, 2017 at 11:56

CommunityBot

11 silver badge

answered Feb 21, 2012 at 10:19

bububaba

2,8706 gold badges27 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

David · Accepted Answer · 2012-02-21 09:53:32Z

0

Check the manual of Zend Zend_Db_Table

It will show you who you can create your own method.

answered Feb 21, 2012 at 9:53

David

1,70711 silver badges24 bronze badges

Collectives™ on Stack Overflow

ZEND_DB_TABLE_ABSTRACT methods SQL INJECTION

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related