Module development clarification
Development and Programming
I’m trying to ensure I add all the recommended security precautions into my code, but don’t want to add pointless checks. The EE documentation is a little fuzzy on the overlap of what certain functions do and don’t do. Could you clarify the follow please…
Using $IN->GBL does XXS cleaning ($REGX->xss_clean) for GETs not POSTs (as documented), but does it also clean the data (I assume so) and prevent SQL Injection ($DB->escape_str)?
Does $IN->clean_input_data() also escape it ($DB->escape_str) or do you have to do that seperately?
Does $TMPL->fetch_param do any cleaning or escaping?
Thanks,
Peter
Peter,
You should always escape user input on a query, so yes, use $DB->escape_str
$TMPL->fetch_param is just grabbing the parameter:
function fetch_param($which)
{
return ( ! isset($this->tagparams[$which])) ? FALSE : $this->tagparams[$which];
}So escape that before you put it into the db.