1

I searched for anti sql-injection code. Folloing code is what i adopted. I want to re-confirm that following php code can prevent sql-injection

$sql_select = "
SELECT
    *
FROM main_tbl
WHERE 
(
  (((main_tbl.from_id = :sender_id) AND (main_tbl.to_id = :to_id)) 
    OR ((main_tbl.to_id = :sender_id) AND (main_tbl.from_id = :to_id)))
  AND
  (main_tbl.last_date > :lasttime)
);
";

$binds = array(
    'sender_id' => $sender_id, 
    'to_id' => $to_id,
    'sender_id' => $sender_id,
    'to_id' => $to_id,
    'lasttime' => $lasttime
);
$resource = Mage::getModel('core/resource');
$read = $resource->getConnection('core_read');
$results = $read->fetchAll($sql_select, $binds);
Knowledge Drilling
  • 986
  • 1
  • 8
  • 22
  • It won't work as your only end up with 3 items in the array, but 5 bound placeholders. (Presuming PDO emulation mode is off) – Lawrence Cherone Aug 03 '18 at 06:47
  • This can be buggy, because i extracted part of source. What about Bind, bind is certainly anti sql-injection code? – Knowledge Drilling Aug 03 '18 at 06:56
  • I'm not sure you what you mean.. generally, if you dont know whats going on in background (didnt read the docs then source), the rule of thumb is if you need to use `:param`'s or `?` in your SQL statements and pass in arrays to the API, then your most likly "anti sql-injection" safe.. – Lawrence Cherone Aug 03 '18 at 07:09

1 Answers1

2

Yes, this code doesn't show any vulnerabilities and should be secure. A good rule of thumb is to always validate the user input.

However your code is a bit flawed, but judging from your comment on your question I assume you already know that.

Classified
  • 560
  • 1
  • 7
  • 21