4 ms·
That is because it is the main repo, the core files of the framework are available in https://github.com/Usbac/wolff-framework https://github.com/Usbac/wolff-fr
by usbac 7y ago
That is because it is the main repo, the core files of the framework are available in https://github.com/Usbac/wolff-framework https://github.com/Usbac/wolff-framework :)
Thanks!
- chupa-chups 7y agoThis looks way more like an actual framework :) But why is it prone to sql injection? https://github.com/Usbac/wolff-framework/blob/master/system/core/DB.php https://github.com/Usbac/wolff-framework/blob/master/system/... (Line 294) (This was the first LOC I randomly picked) Oh well, I better stop looking further. https://stackoverflow.com/questions/60174/how-can-i-pr https://stackoverflow.com/questions/60174/how-can-i-pr
- usbac 7y agoThe table names, column names and conditions cannot be binded into the PDO queries as parameters. The schema functions and fast functions of the DB class are not supposed to be used with user generated input. But anyway, I updated the framework and now any character that is not a letter, number or underscore is removed from the parameters that represent a table or column name. Also, a warning has been added to those function documentation's thanks to your comment. Thank you :)