SQL injection possible?

Next topic

Author	Message
Claudia Kosny	Friday 03 November 2006 1:18:12 am Hi there My users can update some data on some objects using a webform. Due to technical reasons I cannot use the regular content/edit functionality so I have written an extension that takes the posted data, checks which attributes are posted for which object and then uses something like this: $contentObjectAttribute->setAttribute('data_int', $postedAttributeContent); for each of attribute. This is working fine but I am wondering how much I should worry about quotation marks or sql injection in the posted data. So are there any cleanup functions in the ez sql interface that I can use or does ez automatically check for and remove and possible problems? Thanks for any tips or hints Claudia
Sascha Frinken	Friday 03 November 2006 3:25:34 am Hi Claudia, afaik your attributes will be stored with eZPersistentObject::storeObject. As you can see in http://pubsvn.ez.no/doxygen/ezpersistentobject_8php-source.html (line 00501 i.e) it makes use of $db->escapeString( $value ) which prevents SQL injection. HTH Sascha

Author

Message

Friday 03 November 2006 1:18:12 am

Hi there

My users can update some data on some objects using a webform. Due to technical reasons I cannot use the regular content/edit functionality so I have written an extension that takes the posted data, checks which attributes are posted for which object and then uses something like this:
$contentObjectAttribute->setAttribute('data_int', $postedAttributeContent);
for each of attribute.

This is working fine but I am wondering how much I should worry about quotation marks or sql injection in the posted data.

So are there any cleanup functions in the ez sql interface that I can use or does ez automatically check for and remove and possible problems?

Thanks for any tips or hints

Claudia

Sascha Frinken

Friday 03 November 2006 3:25:34 am

Hi Claudia,

afaik your attributes will be stored with eZPersistentObject::storeObject.
As you can see in http://pubsvn.ez.no/doxygen/ezpersistentobject_8php-source.html (line 00501 i.e) it makes use of $db->escapeString( $value ) which prevents SQL injection.

HTH

Sascha

eZ debug

Timing:	Jan 18 2025 16:18:12
Script start
Timing:	Jan 18 2025 16:18:12
Module start 'layout'
Timing:	Jan 18 2025 16:18:12
Module start 'content'
Timing:	Jan 18 2025 16:18:13
Module end 'content'
Timing:	Jan 18 2025 16:18:13
Script end

Main resources:

Total runtime	1.0365 sec
Peak memory usage	4,096.0000 KB
Database Queries	54

Timing points:

Checkpoint	Start (sec)	Duration (sec)	Memory at start (KB)	Memory used (KB)
Script start	0.0000	0.0060	589.0234	152.6250
Module start 'layout'	0.0060	0.0032	741.6484	39.4297
Module start 'content'	0.0092	1.0257	781.0781	459.2422
Module end 'content'	1.0349	0.0016	1,240.3203	8.1875
Script end	1.0365		1,248.5078

Time accumulators:

Accumulator	Duration (sec)	Duration (%)	Count	Average (sec)
Ini load
Load cache	0.0033	0.3215	16	0.0002
Check MTime	0.0014	0.1337	16	0.0001
Mysql Total
Database connection	0.0008	0.0819	1	0.0008
Mysqli_queries	0.9931	95.8148	54	0.0184
Looping result	0.0005	0.0515	52	0.0000
Template Total	1.0035	96.8	2	0.5018
Template load	0.0023	0.2237	2	0.0012
Template processing	1.0012	96.5911	2	0.5006
Template load and register function	0.0002	0.0213	1	0.0002
states
state_id_array	0.0007	0.0658	1	0.0007
state_identifier_array	0.0021	0.2001	2	0.0010
Override
Cache load	0.0019	0.1847	17	0.0001
Sytem overhead
Fetch class attribute can translate value	0.0010	0.0924	2	0.0005
Fetch class attribute name	0.0014	0.1364	2	0.0007
XML
Image XML parsing	0.0003	0.0301	2	0.0002
class_abstraction
Instantiating content class attribute	0.0000	0.0010	2	0.0000
General
dbfile	0.0010	0.0917	10	0.0001
String conversion	0.0000	0.0007	4	0.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

Usage	Requested template	Template	Template loaded
1	node/view/full.tpl	full/forum_topic.tpl	extension/sevenx/design/simple/override/templates/full/forum_topic.tpl
2	content/datatype/view/ezxmltext.tpl	<No override>	extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tpl
4	content/datatype/view/ezxmltags/paragraph.tpl	<No override>	extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tpl
2	content/datatype/view/ezxmltags/line.tpl	<No override>	design/standard/templates/content/datatype/view/ezxmltags/line.tpl
1	print_pagelayout.tpl	<No override>	extension/community/design/community/templates/print_pagelayout.tpl
Number of times templates used: 10 Number of unique templates used: 5

Time used to render debug report: 0.0001 secs