Forums / Developer / addslashes() equivalent for securing custom database queries

addslashes() equivalent for securing custom database queries

« 
Previous topic
|
Developer
|
Next topic
 »
Author Message

Piotrek Karaś

Thursday 13 December 2007 1:09:47 am

Ello,

What would be the best way of securing custom database queries in custom classes? I have searched the entire installation for 'addslashes' string, but it's only been used once and not exactly in a context that could serve as a tool. Is there any recommended/core supported function or method for escaping any potentially dangerous characters, or is it dealt with on datatype-to-datatype basis?

Thanks,
Piotrek

--
Company: mediaSELF Sp. z o.o., http://www.mediaself.pl
eZ references: http://ez.no/partners/worldwide_partners/mediaself
eZ certified developer: http://ez.no/certification/verify/272585
eZ blog: http://ez.ryba.eu

Łukasz Serwatka

Thursday 13 December 2007 1:46:16 am

Hi Piotrek,

You can use escapeString() ezdbinterface.php

    /*!
      \pure
      Will escape a string so it's ready to be inserted in the database.
    */
    function escapeString( $str )
    {
        return $str;
    }

Re-implemented in ezmysqldb.php

$db = eZDB::instance();
$db->escapeString( $str );

When you are using eZPresistentObject for storing content it will handle it automatically.

Personal website -> http://serwatka.net
Blog (about eZ Publish) -> http://serwatka.net/blog

Piotrek Karaś

Thursday 13 December 2007 3:35:18 am

Łukasz,

This is exactly it!
Sometimes it's difficult to locate some wrappers, especially if you don't know if they exist, but I'm getting an impression that there will be one for anything in eZ ;)

Thanks!

--
Company: mediaSELF Sp. z o.o., http://www.mediaself.pl
eZ references: http://ez.no/partners/worldwide_partners/mediaself
eZ certified developer: http://ez.no/certification/verify/272585
eZ blog: http://ez.ryba.eu

eZ debug

Timing: Jan 18 2025 22:17:04
Script start
Timing: Jan 18 2025 22:17:04
Module start 'content'
Timing: Jan 18 2025 22:17:05
Module end 'content'
Timing: Jan 18 2025 22:17:06
Script end

Main resources:

Total runtime1.3502 sec
Peak memory usage4,096.0000 KB
Database Queries194

Timing points:

CheckpointStart (sec)Duration (sec)Memory at start (KB)Memory used (KB)
Script start 0.00000.0071 589.0859180.7969
Module start 'content' 0.00711.1793 769.8828557.7109
Module end 'content' 1.18630.1638 1,327.5938336.7109
Script end 1.3501  1,664.3047 

Time accumulators:

 Accumulator Duration (sec) Duration (%) Count Average (sec)
Ini load
Load cache0.00490.3617210.0002
Check MTime0.00150.1074210.0001
Mysql Total
Database connection0.00120.090910.0012
Mysqli_queries1.268193.91421940.0065
Looping result0.00230.17161920.0000
Template Total1.316597.520.6582
Template load0.00240.180420.0012
Template processing1.314097.316920.6570
Template load and register function0.00010.006510.0001
states
state_id_array0.00090.069910.0009
state_identifier_array0.00100.077220.0005
Override
Cache load0.00200.1455220.0001
Sytem overhead
Fetch class attribute can translate value0.00150.111830.0005
Fetch class attribute name0.00170.122350.0003
XML
Image XML parsing0.00120.091130.0004
class_abstraction
Instantiating content class attribute0.00000.001060.0000
General
dbfile0.00430.3200360.0001
String conversion0.00000.000630.0000
Note: percentages do not add up to 100% because some accumulators overlap

CSS/JS files loaded with "ezjscPacker" during request:

CacheTypePacklevelSourceFiles
CSS0extension/community/design/community/stylesheets/ext/jquery.autocomplete.css
extension/community_design/design/suncana/stylesheets/scrollbars.css
extension/community_design/design/suncana/stylesheets/tabs.css
extension/community_design/design/suncana/stylesheets/roadmap.css
extension/community_design/design/suncana/stylesheets/content.css
extension/community_design/design/suncana/stylesheets/star-rating.css
extension/community_design/design/suncana/stylesheets/syntax_and_custom_tags.css
extension/community_design/design/suncana/stylesheets/buttons.css
extension/community_design/design/suncana/stylesheets/tweetbox.css
extension/community_design/design/suncana/stylesheets/jquery.fancybox-1.3.4.css
extension/bcsmoothgallery/design/standard/stylesheets/magnific-popup.css
extension/sevenx/design/simple/stylesheets/star_rating.css
extension/sevenx/design/simple/stylesheets/libs/fontawesome/css/all.min.css
extension/sevenx/design/simple/stylesheets/main.v02.css
extension/sevenx/design/simple/stylesheets/main.v02.res.css
JS0extension/ezjscore/design/standard/lib/yui/3.17.2/build/yui/yui-min.js
extension/ezjscore/design/standard/javascript/jquery-3.7.0.min.js
extension/community_design/design/suncana/javascript/jquery.ui.core.min.js
extension/community_design/design/suncana/javascript/jquery.ui.widget.min.js
extension/community_design/design/suncana/javascript/jquery.easing.1.3.js
extension/community_design/design/suncana/javascript/jquery.ui.tabs.js
extension/community_design/design/suncana/javascript/jquery.hoverIntent.min.js
extension/community_design/design/suncana/javascript/jquery.popmenu.js
extension/community_design/design/suncana/javascript/jScrollPane.js
extension/community_design/design/suncana/javascript/jquery.mousewheel.js
extension/community_design/design/suncana/javascript/jquery.cycle.all.js
extension/sevenx/design/simple/javascript/jquery.scrollTo.js
extension/community_design/design/suncana/javascript/jquery.cookie.js
extension/community_design/design/suncana/javascript/ezstarrating_jquery.js
extension/community_design/design/suncana/javascript/jquery.initboxes.js
extension/community_design/design/suncana/javascript/app.js
extension/community_design/design/suncana/javascript/twitterwidget.js
extension/community_design/design/suncana/javascript/community.js
extension/community_design/design/suncana/javascript/roadmap.js
extension/community_design/design/suncana/javascript/ez.js
extension/community_design/design/suncana/javascript/ezshareevents.js
extension/sevenx/design/simple/javascript/main.js

Templates used to render the page:

UsageRequested templateTemplateTemplate loadedEditOverride
1node/view/full.tplfull/forum_topic.tplextension/sevenx/design/simple/override/templates/full/forum_topic.tplEdit templateOverride template
3content/datatype/view/ezimage.tpl<No override>extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tplEdit templateOverride template
3content/datatype/view/ezxmltext.tpl<No override>extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tplEdit templateOverride template
7content/datatype/view/ezxmltags/paragraph.tpl<No override>extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tplEdit templateOverride template
2content/datatype/view/ezxmltags/line.tpl<No override>design/standard/templates/content/datatype/view/ezxmltags/line.tplEdit templateOverride template
2content/datatype/view/ezxmltags/literal.tpl<No override>extension/community/design/standard/templates/content/datatype/view/ezxmltags/literal.tplEdit templateOverride template
1pagelayout.tpl<No override>extension/sevenx/design/simple/templates/pagelayout.tplEdit templateOverride template
 Number of times templates used: 19
 Number of unique templates used: 7

Time used to render debug report: 0.0001 secs