{"id":4223,"date":"2022-08-22T00:26:17","date_gmt":"2022-08-21T18:56:17","guid":{"rendered":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/"},"modified":"2022-08-22T00:26:17","modified_gmt":"2022-08-21T18:56:17","slug":"solved-how-to-prevent-sql-injections-in-manually-created-queries","status":"publish","type":"post","link":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/","title":{"rendered":"[Solved] How to prevent SQL injections in manually created queries?"},"content":{"rendered":"<p> [ad_1]<br \/>\n<\/p>\n<div id=\"answer-41650249\" class=\"answer js-answer accepted-answer js-accepted-answer\" data-answerid=\"41650249\" data-parentid=\"41647877\" data-score=\"1\" data-position-on-page=\"1\" data-highest-scored=\"1\" data-question-has-accepted-highest-score=\"1\" itemprop=\"acceptedAnswer\" itemscope itemtype=\"https:\/\/schema.org\/Answer\">\n<div class=\"post-layout\">\n<div class=\"votecell post-layout--left\"><\/div>\n<div class=\"answercell post-layout--right\">\n<div class=\"s-prose js-post-body\" itemprop=\"text\">\n<blockquote>\n<p>I dont want to use other method<\/p>\n<\/blockquote>\n<p>You should use whatever provides the required functionality, not the method that you like more over others!<\/p>\n<p>Also you should never access superglobals directly in CakePHP, this will only bring you in trouble, especially in unit tests. User the proper abstracted methodes provided by the request object, that is <code>CakeRequest::query()<\/code>.<\/p>\n<p><strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/book.cakephp.org\/2.0\/en\/controllers\/request-response.html#accessing-querystring-parameters\">Cookbook &gt; Controllers &gt; Request and Response objects &gt; Accessing Querystring parameters<\/a><\/strong><\/p>\n<hr>\n<h2>Use prepared statements<\/h2>\n<p>That being said, use prepared statements, either by passing the values to bind to the second argument of <code>Model::query()<\/code>:<\/p>\n<pre><code>$result = $this-&gt;Search-&gt;query(\n    \"select * from subcategories where subcat_name like ? and subcat_status=\"active\"\",\n    array('%' . $this-&gt;request-&gt;query('searchkey') . '%')\n);\n<\/code><\/pre>\n<p><strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/api.cakephp.org\/2.9\/class-Model.html#_query\">API &gt; Model::query()<\/a><\/strong><\/p>\n<p>or by using <code>DboSource::fetchAll()<\/code>, which accepts parameters as the second argument too:<\/p>\n<pre><code>$db = $this-&gt;Search-&gt;getDataSource();\n$result = $db-&gt;fetchAll(\n    \"select * from subcategories where subcat_name like ? and subcat_status=\"active\"\",\n    array('%' . $this-&gt;request-&gt;query('searchkey') . '%')\n);\n<\/code><\/pre>\n<ul>\n<li><strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/book.cakephp.org\/2.0\/en\/models\/retrieving-your-data.html#prepared-statements\">Cookbook &gt; Models &gt; Retrieving Your Data &gt; Prepared Statements<\/a><\/strong><\/li>\n<li><strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/api.cakephp.org\/2.9\/class-DboSource.html#_fetchAll\">API &gt; DboSource::fetchAll()<\/a><\/strong><\/li>\n<\/ul>\n<h2>Escape manually<\/h2>\n<p>For the sake of completeness, it&#8217;s also possible to manually escape the value via <code>DboSource::value()<\/code>, <strong>however you should avoid constructing query strings that way at all costs<\/strong>, as a small mistake can end up causing an unescaped value to be inserted, thus creating a possible SQL injection vulnerability: <\/p>\n<pre><code>$searchkey = $this-&gt;request-&gt;query('searchkey');\n\n$db = $this-&gt;Search-&gt;getDataSource();\n$value = $db-&gt;value('%' . $searchkey . '%', 'string');\n\n$result = $this-&gt;Search-&gt;query(\n    \"select * from subcategories where subcat_name like $value and subcat_status=\"active\"\"\n);\n<\/code><\/pre>\n<p><strong><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/api.cakephp.org\/2.9\/class-DboSource.html#_value\">API &gt; DboSource::value()<\/a><\/strong><\/p>\n<\/p><\/div>\n<div class=\"mt24\"><\/div>\n<\/div>\n<p>            <span class=\"d-none\" itemprop=\"commentCount\">2<\/span> <\/p><\/div>\n<\/div>\n<p>[ad_2]<\/p>\n<p>solved How to prevent SQL injections in manually created queries? <\/p>\n","protected":false},"excerpt":{"rendered":"<p>[ad_1] I dont want to use other method You should use whatever provides the required functionality, not the method that you like more over others! Also you should never access superglobals directly in CakePHP, this will only bring you in trouble, especially in unit tests. User the proper abstracted methodes provided by the request object, &#8230; <a title=\"[Solved] How to prevent SQL injections in manually created queries?\" class=\"read-more\" href=\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\" aria-label=\"More on [Solved] How to prevent SQL injections in manually created queries?\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[320],"tags":[696,697,698,339],"class_list":["post-4223","post","type-post","status-publish","format-standard","hentry","category-solved","tag-cakephp","tag-cakephp-2-0","tag-cakephp-2-3","tag-php"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>[Solved] How to prevent SQL injections in manually created queries? - JassWeb<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[Solved] How to prevent SQL injections in manually created queries? - JassWeb\" \/>\n<meta property=\"og:description\" content=\"[ad_1] I dont want to use other method You should use whatever provides the required functionality, not the method that you like more over others! Also you should never access superglobals directly in CakePHP, this will only bring you in trouble, especially in unit tests. User the proper abstracted methodes provided by the request object, ... Read more\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\" \/>\n<meta property=\"og:site_name\" content=\"JassWeb\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-21T18:56:17+00:00\" \/>\n<meta name=\"author\" content=\"Kirat\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kirat\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\"},\"author\":{\"name\":\"Kirat\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\"},\"headline\":\"[Solved] How to prevent SQL injections in manually created queries?\",\"datePublished\":\"2022-08-21T18:56:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\"},\"wordCount\":194,\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"keywords\":[\"cakephp\",\"cakephp-2.0\",\"cakephp-2.3\",\"php\"],\"articleSection\":[\"Solved\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\",\"url\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\",\"name\":\"[Solved] How to prevent SQL injections in manually created queries? - JassWeb\",\"isPartOf\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#website\"},\"datePublished\":\"2022-08-21T18:56:17+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jassweb.com\/solved\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[Solved] How to prevent SQL injections in manually created queries?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jassweb.com\/solved\/#website\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"name\":\"JassWeb\",\"description\":\"Build High-quality Websites\",\"publisher\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jassweb.com\/solved\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jassweb.com\/solved\/#organization\",\"name\":\"Jass Web\",\"url\":\"https:\/\/jassweb.com\/solved\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"contentUrl\":\"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png\",\"width\":693,\"height\":132,\"caption\":\"Jass Web\"},\"image\":{\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31\",\"name\":\"Kirat\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750\",\"contentUrl\":\"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750\",\"caption\":\"Kirat\"},\"sameAs\":[\"http:\/\/jassweb.com\"],\"url\":\"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[Solved] How to prevent SQL injections in manually created queries? - JassWeb","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/","og_locale":"en_US","og_type":"article","og_title":"[Solved] How to prevent SQL injections in manually created queries? - JassWeb","og_description":"[ad_1] I dont want to use other method You should use whatever provides the required functionality, not the method that you like more over others! Also you should never access superglobals directly in CakePHP, this will only bring you in trouble, especially in unit tests. User the proper abstracted methodes provided by the request object, ... Read more","og_url":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/","og_site_name":"JassWeb","article_published_time":"2022-08-21T18:56:17+00:00","author":"Kirat","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kirat","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/#article","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/"},"author":{"name":"Kirat","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31"},"headline":"[Solved] How to prevent SQL injections in manually created queries?","datePublished":"2022-08-21T18:56:17+00:00","mainEntityOfPage":{"@id":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/"},"wordCount":194,"publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"keywords":["cakephp","cakephp-2.0","cakephp-2.3","php"],"articleSection":["Solved"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/","url":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/","name":"[Solved] How to prevent SQL injections in manually created queries? - JassWeb","isPartOf":{"@id":"https:\/\/jassweb.com\/solved\/#website"},"datePublished":"2022-08-21T18:56:17+00:00","breadcrumb":{"@id":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jassweb.com\/solved\/solved-how-to-prevent-sql-injections-in-manually-created-queries\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jassweb.com\/solved\/"},{"@type":"ListItem","position":2,"name":"[Solved] How to prevent SQL injections in manually created queries?"}]},{"@type":"WebSite","@id":"https:\/\/jassweb.com\/solved\/#website","url":"https:\/\/jassweb.com\/solved\/","name":"JassWeb","description":"Build High-quality Websites","publisher":{"@id":"https:\/\/jassweb.com\/solved\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jassweb.com\/solved\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jassweb.com\/solved\/#organization","name":"Jass Web","url":"https:\/\/jassweb.com\/solved\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/","url":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","contentUrl":"https:\/\/jassweb.com\/wp-content\/uploads\/2021\/02\/jass-website-logo-1.png","width":693,"height":132,"caption":"Jass Web"},"image":{"@id":"https:\/\/jassweb.com\/solved\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/65c9c7b7958150c0dc8371fa35dd7c31","name":"Kirat","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jassweb.com\/solved\/#\/schema\/person\/image\/","url":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750","contentUrl":"https:\/\/jassweb.com\/solved\/wp-content\/litespeed\/avatar\/1261af3c9451399fa1336d28b98ea3bb.jpg?ver=1775798750","caption":"Kirat"},"sameAs":["http:\/\/jassweb.com"],"url":"https:\/\/jassweb.com\/solved\/author\/jaspritsinghghumangmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/4223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/comments?post=4223"}],"version-history":[{"count":0,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/posts\/4223\/revisions"}],"wp:attachment":[{"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/media?parent=4223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/categories?post=4223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jassweb.com\/solved\/wp-json\/wp\/v2\/tags?post=4223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}