Thread

Hi

Is it safe to use segment variables in the weblog entries tag? I want to be sure that it’s not possible for someone to modify a URL segment in such a way that could be used in a SQL injection attack.

For example:

{exp:weblog:entries weblog="{segment_2}" url_title="{segment_3}"}

Let’s say someone modified the third segment to include some SQL code. Is that a potential scenario that could be exploited?

I’m sure I’m worrying over nothing, but I wanted to check anyway.

I had similar concerns about dynamic parameters, so I’ve avoided using them for now, just in case.

Thanks
Simon

Ominous lack of response to this. Should I have posted it in one of the other forums?

Simon

Hi, Simon -

Yes, they are sanitized and safe.

If you use them in conditionals, do read troubleshooting conditionals first.

Thanks Lisa, that’s good to know.