How to write secure Yii1 applications

Comparing #13 with #15

Revision #15 was created by CeBe CeBe on Jun 20, 2013, 11:47:48 PM.

fixed example code of CJavaScript::encode

Content

[...]
<?php
$messages = array("Rock'n roll", 'Say "hello"');
$title = "D'accord";
Yii::app()->clientScript->registerScript('snippet', "
function displayMsg() {
var messages = <?php echo" . CJavaScript::encode($messages); ?> . "; var title = '<?php echo" . CJavaScript::quote($title); ?> . "';
// ...
}
[...]
```php
<?php
// still lacks validation (see "Validating user input" above), but more secure MyModel::model()->findByPk((int)$_GET['id'])->delete(); // uses validation with a type cast
 
$comments = Comment::model->findAllByAttributes(array('user_id' => (int)$_GET['id']);
```

This is a general principle: if you build your SQL condition in pure text, you take more risks than a more PHP approach.
For most DB functions, **prefer array parameters to string parameters**.
Here is another example using PHP arrays:
[...]