News for hackers. Stuff that matters.

A comment on Show HN: A “Write Less, Do More” DB Class Based on PDO [PHP]. Parent comment

Re:Show HN: A “Write Less, Do More” DB Class Based on PDO [PHP] by _lce0 on Friday January 02, 2015 @01:26AM (#8825767)
No matter how hard you try. If queries are dynamically created, you (or your lib's user) will most certainly miss a spot were an attacker cloud sneak an offensive query.

You fixed the $i, but what about $table? What about $conditions's keys?

See the problem? And we are just talking about a single method ;-)

[ Parent | on HN ]
Re:Show HN: A “Write Less, Do More” DB Class Based on PDO [PHP] by sarciszewski on Friday January 02, 2015 @07:44AM (#8826558)
Valid points, but regrettably they were ones I had already addressed in subsequent changes.

I linked to a single commit.

I probably should have linked to the master branch instead. (Also, I just pushed another update as I wrote this.)

https://github.com/resonantcore/lib/blob/master/src/DB.php

[ Parent | on HN ]