[Deprecated] DMZ 1.5.3 (DataMapper OverZealous Edition)

[eluser]OverZealous[/eluser]
[quote author="someoneinomaha" date="1252202053"]I'm really enjoying working with DMZ so far... thanks for the great library.[/quote]

Thanks for your support!

Is there any protection against SQL injection?

Everything that DMZ does to the database runs through Active Record. This means that all values are escaped (preventing SQL injection). Column names are not escaped, however, but you should never accept any sort of SQL from the client anyway.

FYI: $this->input->post() does not provide any sort of SQL injection protection. It merely is a shortcut to handling whether a field was returned, or if not, it returns FALSE. (See here.)

Using the input->post method with the optional second parameter set to TRUE will perform XSS cleaning, but that also provides no SQL injection protection. XSS is a different (and more subtle) form of attack. DMZ handles XSS cleaning through validation rules, namely 'xss_clean'.