3 ms·
OK you got me on those 2 cases. For sort order: $sort_order=="ASC"?"ASC":"DESC" For offsets and limits convert/parse it to a number first and ensure it's with
by axod 17y ago
OK you got me on those 2 cases.
For sort order:
$sort_order=="ASC"?"ASC":"DESC"
For offsets and limits convert/parse it to a number first and ensure it's within sane bounds.
You're right though. Parameterization isn't a magic bullet that allows you to forget about all other unclean data if you're using other unclean data in an SQL query.
Surely we all know this though? :/
- tptacek 17y agoMy advice is, pass page= as your pagination and pass 1/0 in for ASC or DESC. If you have selectable columns, number them in the parameters, don't name them. Point being, when you compose the query, you should never be inserting text from parameters; you should be converting parameters into known-good values.