Re: [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack
| From: | Christoph Becker | Date: | Tue, 11 Aug 2015 23:43:32 +0000 |
| Subject: | Re: [RFC] Block requests to builtin SQL functions where PHP can prove the call is vulnerable to a potential SQL-injection attack | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-87726@lists.php.net to get a copy of this message | ||
On 10.08.2015 at 11:57, Craig Francis wrote:
> You only have to skim read things like the second comment (with 27 up votes) on the PDO prepare
> page to see that these problems are happening all the time:
>
>
> http://php.net/manual/en/pdo.prepare.php#111458
> SELECT * FROM users WHERE $search=:email
"Skim reading" things might be the problem (here). The user contributed
note states:
| In my case I allow the user to enter their username or email,
| determine which they've entered and set $search to "username" or
| "email". As this value is not entered by the user there is no
| potential for SQL injection and thus safe to use as I have done.
So to me that note looks pretty fine.
--
Christoph M. Becker