Details
-
Type:
Docs: Improvement
-
Status:
Resolved
-
Priority:
Minor
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: 1.9.6
-
Component/s: Zend_OpenId
-
Labels:None
-
Language:English
Description
I must admit I am not wholly familiar with either Zend_Db or Zend_OpenId, but the code examples in Example 38.7. Database Storage
worry me because they just seem to trust the incoming data so much.
e.g
public function delAssociation($url)
{ $table = $this->_association_table; $this->_db->query("delete from $table where url = '$url'"); return true; }------
I think it would be wise to mention somewhere in the docs how we know that $url is not going to carry an SQL injection attack so that paranoid folk like me don't get anxious when reading it.
All documentation examined for bad security and update; fixes committed to trunk and 1.9 release branch.