3 ms·
That's a very obvious SQL injection, and a completely unnecessary one. I don't actually know how PHP handles this, but usually it's really not any more work to
by fabian2k 5y ago
That's a very obvious SQL injection, and a completely unnecessary one. I don't actually know how PHP handles this, but usually it's really not any more work to pass parameters as parameters and not concatenate them into the SQL string. And SQL injections are not an obscure or difficult to understand subject, it's probably the most obvious common security issue.
There are cases where it's more annoying to do stuff in plain SQL and where you'd have to concatenate strings. But this is not one of them, is a simple parameter that needs to be passed to the query.
- mpol 5y agoIn WordPress there is the `$wpdb` class, that abstracts database access away. It is advised to use `$wpdb->prepare()` with prepared statements. Then you have an array with placeholders and an array with values, which the `$wpdb` class should handle correctly. But looking at this code, simply casting to an int with `(int) $id` in the `set_id()` method would have been enough.