PHP security
| From: | Skye Poier | Date: | Mon, 16 Jan 2006 23:01:55 +0000 |
| Subject: | PHP security | ||
| Groups: | php.pear.general | ||
| Request: | Send a blank email to pear-general+get-22554@lists.php.net to get a copy of this message | ||
I'm copying the values from QuickForm $form->getSubmitValue() into DataObjects and then calling the objects' update() method to update the database, does it handle all quoting for me? Am I pretty much safe from SQL injection attacks using this method?
I'm using Flexy and QuickForms for all DB data presentation, so that should protect from XSS attacks. I guess the only danger there is using a Flexy {tag:h} and allowing HTML in the template where it shouldn't be allowed.
Thanks,
Skye