1

I understand that parameterized queries are essential when user-submitted data is on the prowl, however my question is whether this applies to user-TAMPERABLE data?

So if we have an url such as ".../?id=1", would it be necessary to prepare any statement using $id or would URL encoding remove the threat?

Joe

Joe McKie
  • 96
  • 1
  • 9
  • Any data that comes from any external source should be parameterised. Although in the `id` example it can be safely handled by simply casting it to an integer. Things that *must* be sanitised in one way or another include (but are not limited to) `$_GET`, `$_POST`, `$_COOKIE` (and implicitly `$_REQUEST`), `$_SERVER`, `$_ENV`, any data read from a file, any data read from a database. – DaveRandom Aug 09 '12 at 10:20
  • Aye I did think it would need preparing, it makes sense! Thanks all – Joe McKie Aug 09 '12 at 10:30
  • Every book, article, blog,... you'll read on this will boil down to this one saying: _Never trust the network_. A request parameter, therefore, cannot be trusted. Yes, it needs preparing – Elias Van Ootegem Aug 09 '12 at 10:37

2 Answers2

4

Why wouldn't you use prepared statements / paramaterised queries for all situations where there is external/variable input?

The only queries you can trust are those where every element is hardcoded, or derived from hardcoded elements within your application.

Do not even trust data that you have pulled from your own database. This counts as external / variable data. A sophisticated attack can use more vectors than a simple "modifying a query string parameter".

I think for the tiny amount of extra code overhead, it is completely worth the peace of mind you will get from knowing your queries are protected.

Leigh
  • 12,859
  • 3
  • 39
  • 60
0

Url encoding would not remove the threat.

Anything that is touchable by the user should be treated as unsafe and a potential threat. You query by id as such not validating it and just shoving it straight into a query can still cause the same injection problems as not using PDO at all.

Sammaye
  • 43,242
  • 7
  • 104
  • 146