[Solved] How to prevent sql injection

jeverd01 · Post by **jeverd01** » Mon Feb 14, 2011 12:59 am

Is there a class / method to sanitize sql. Should I sanitize everything that is passed in the admin panel as params, or is this somehow handled by cmsms automatically?

Also any tips on how to read the api docs would be appeciated. I can't seem to find anything I am looking for !

jeverd01 · Post by **jeverd01** » Mon Feb 14, 2011 1:20 am

I see that adodb lite is used. Does this sanitize data when execute is ran? I can't seem to find the answer to this in the docs.

Wishbone · Post by **Wishbone** » Mon Feb 14, 2011 2:01 am

Look at an existing module's <module>.module.php. Look at the SetParameters() function. This allows you to restrict which parameters are used, and tell CMSMS the type, i.e. CLEAN_INT, CLEAN_STRING.. If the parameter doesn't match your criteria, it will be removed.

CMS Made Simple Forums

[Solved] How to prevent sql injection

[Solved] How to prevent sql injection

Re: How to prevent sql injection

Re: How to prevent sql injection