SQL Injection and Codeigniter -

SQL Injection and Codeigniter -

some doubts regarding codeigniter , input handling capabilities. may little weird doubts none-the-less.

if utilize active record class functions in codeigniter, input prevented against sql injection? i read somewhere does, don't understand how? or why? also xssclean deal sql injection in way?

is input prevented against sql injection?

not ‘automatically’, provide parameterised queries. codeigniter or no, should utilize parameterised queries in preference query string hacking whenever possible.

$bof= "a'b"; $zot= 'a\b'; // insecure! don't this! // $this->db->query("select foo bar bof='$bof' , zot='$zot'"); // secure annoying write // $this->db->query("select foo bar bof='".$this->db->escape($bof)."' , zot='".$this->db->escape($zot)."'"); // want // $this->db->query('select foo bar bof=? , zot=?', array($bof, $zot));

note nil ‘input’: when create sql query strings must utilize parameterisation or escaping create them fit, regardless of whether they're user input or not. matter of simple correctness; security side-effect of correctness.

similarly when output text html, need html-encode <, & , " characters in then. absolutely no utilize trying fiddle input escape or remove characters might troublesome in future if happen utilize them without escaping in sql or html. you'll mangle output having unexpected sql-escaping in html (which why see self-multiplying backslashes in badly-written apps) , unwanted html-escaping in sql. , should take text somewhere other direct user input (say, material in database) aren't protected @ all.

also xssclean deal sql injection in way?

no. it's aimed @ html injection. it's worse worthless. never utilize it.

“xss filtering” bogus (again, codeigniter's or else's). xss needs prevented correctly html-escaping output, not mangling input. xss filtering not adequately protect if application not secure; @ best obfuscate existing flaws , give false sense of security. mangle lot of valid input ci thinks looks tags.

codeigniter sql-injection