Yii Security-extended guide

Comparing #22 with #23

Revision #23 was created by bingjie2680 bingjie2680 on Nov 22, 2011, 10:22:06 AM.

correct

Content

[...]
<li>Input validation, do not trust any data from client side, always validate.</li>
<li>Avoid write raw SQL statement in controller, if you have to, pay great attention to the input.</li>
<li>Use prepared statment,in Yii, use methods in activeRecord or CDbCommand to pass $params.</li>
</ol>

**Magic Urls**

Another attack that you should pay attention to is the so called Magic Url. this attack happens when developers use parameters in the url as input and execute some operation on the server side. In particular, the architecture of Yii framework has opens the door to this attack. Without proper authentication guides and other countermeasures, attackers may be able to delete all the data you have in your database. so let's look at a concrete example:

Imagin you have a ImageController which contains common methods:
[...]