Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Issue #1

Open
DolUnity opened this issue Mar 12, 2020 · 5 comments
Open

Security Issue #1

DolUnity opened this issue Mar 12, 2020 · 5 comments

Comments

@DolUnity
Copy link

DolUnity commented Mar 12, 2020

Hello Timy,
I've found some security issues in your methods. First of all mysqli is outdated, for new webapplications you should use pdo or an orm like doctrine. Next you are not using prepared statements. Like you have done it an SQL injection is quite easy.
Also why are you creating always a new connection for each method and dont just create the connection in the construct method and safe it as an private variable in your class.

@TimyStream
Copy link
Owner

First, Why is mysqli outdated ?
Second, this with the prepared statements i can understand an will change it in the Future
Third, the point with the Private variable is not an bad idea :)

@DolUnity
Copy link
Author

DolUnity commented Mar 13, 2020

Well, the mysqli connector isn't completely outdated. Its just that PDO is featuring more functions then mysqli and will be the new primary connector. For example: with PDO you can return directly an array of your selectet entities and must not create a loop to put them into an array.

@TimyStream
Copy link
Owner

Sure but this is not directly the purpose of this Libary

@DolUnity
Copy link
Author

You could save up some line of code?

@TimyStream
Copy link
Owner

I can, but like i said the purpose of this Libary is to easy work with a database. I can update it to the PDO but i would make a second branch explicit for PDO. Then we can Cover both the "Mysqli" and the "PDO" Connector 😄 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants