Peter Broekman asked 5 years ago
Abu,
I make use of a .sql file to have the php file lighter and have more overview, like below. In this sql I defined a string ‘varuserid’, that I replace with $userid being the user that logs in. Below actually works, but should I do this with binding the paramater for safety reasons?
see below the .sql latest part where I ‘defined’ ‘varuserid’
$sqlFEC502 = file_get_contents(“queries/FE-C50-2-Edit table People (hours time time).sql”);
$sqlFEC502 = str_replace(“varuserid”,$userid,$sqlFEC502);
$g->select_command = $sqlFEC502;
Peter Broekman answered 5 years ago
Hello,
Considering security perspective, every data from client side (post,get,cookie) is considered unsafe unless sanitized.
So its better to check if it contains expected range of values before using in query.
$sqlFEC502 = str_replace(“varuserid”,$userid,$sqlFEC502);
If this userid is posted from client and its numeric, so its better to do
$userid = intval($userid);
This will either make it 0 if non-numeric data is posted.
If it is taken from session, then no issues.
Regards,
— Abu Ghufran
