SQL Injection Attacks

Yii 1.1 General Discussion
1

Does yii prevent injection attacks automatically or do I need to enter code to prevent them?

Thanks

2

It is a good start to use the framework as shown in the guide.

Do not forget to validate fields and use prepared statements when querying the database.

3

Yii add slashes before saving attributes. For search statement, use parameters:




$criteria->addcondition("field= :field");

$criteria->params(':field'=>$userInputedField);

Whit such configuration yii prevents from sql injection.

If you use somthing like:




$criteria->addcondition("field= $userInputedField");

You are resposible for the content of $userInputedField (i.e: is dangerous)

4

zaccaria made it more clear :)

You won’t use prepared statements directly, but will use parameters, as he said above.

Also, I’d like to add that Yii uses parameters (then prepared statements) when saving an active record.

5

So, should we do array_walk to addslashes every parameters comping from and activerecord post?!