Welcome Guest, Not a member yet? Register   Sign In
Doesn't active record sanitize input anymore?
#6

[eluser]FinalFrag[/eluser]
I have made a new controller and model, just to test this. I will share the code with you, maybe this helps you guys to solve my problem.

Controller: todoManagement.php
Code:
<?php
class TodoManagement extends Controller {
function TodoManagement()
{
    parent::Controller();
    $this->load->model('Testmodel');
}

function index()
{
    // Write something to the testmodel
    $this->Testmodel->write("' this should <b>get</b> ' filtered '");
}
}

Model: testmodel.php
Code:
&lt;?php
class Testmodel extends Model {
function Testmodel()
{
    // Call the Model constructor
    parent::Model();
}

function write($string)
{
    $this->db->set('userId', 1);
    $this->db->set('name', $string);
    $this->db->insert('finalfrag_todoLists');
}
}

When I execute this code by visiting www.myurl.com/todoManagement the following gets put in the database:
Code:
1
' this should <b>get</b> ' filtered '

But that's not what I want to written to the database (for SQL injection reasons). What I want is
Code:
1
\' this should &lt;b&gt;get&lt;/b&gt; \' filtered \'

My test code was done on the same CI install as my previous posts... I will go and test it on a different install...

If you can spot my mistake... please help me...


Messages In This Thread
Doesn't active record sanitize input anymore? - by El Forum - 12-13-2008, 05:52 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-13-2008, 07:19 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-13-2008, 07:40 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-13-2008, 09:40 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-14-2008, 07:54 AM
Doesn't active record sanitize input anymore? - by El Forum - 12-14-2008, 10:48 AM
Doesn't active record sanitize input anymore? - by El Forum - 12-14-2008, 12:24 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-14-2008, 01:23 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-14-2008, 01:27 PM
Doesn't active record sanitize input anymore? - by El Forum - 12-14-2008, 01:33 PM



Theme © iAndrew 2016 - Forum software by © MyBB