Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:115036
MIME-Version: 1.0
References: <4FFA0160-1A05-4DA0-9C9A-79F778443A35@newclarity.net>
 <CAGBsUre=Asp+arHBWK0VdT-YdM=_3rR+WOhQQeghFVwsR+nGUg@mail.gmail.com>
 <F861461F-D070-4808-8B2E-A9BBF753CE6C@newclarity.net> <9e8faf2b-fdc7-49f4-bdc1-0822841616e2@www.fastmail.com>
 <9ACF5579-6721-4C23-B725-1018B7971B20@newclarity.net> <6ab93b1c-816e-40d5-a831-2f755fd7aeb5@www.fastmail.com>
In-Reply-To: <6ab93b1c-816e-40d5-a831-2f755fd7aeb5@www.fastmail.com>
Date: Tue, 22 Jun 2021 18:22:59 +0100
Message-ID: <CAGBsUrc9=d5N662NvkdY=1sLyQ+R9UHzaXeP10MTM2zZKPRp1A@mail.gmail.com>
To: Larry Garfield <larry@garfieldtech.com>
Cc: php internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000046bfa005c55e0b10"
Subject: Re: [PHP-DEV] Sql Object Model Parser & Sanitizer (was [RFC] is_literal)
From: tekiela246@gmail.com (Kamil Tekiela)

--00000000000046bfa005c55e0b10
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

This is open to SQL injection:

$queryBuilder
    ->select(...$_GET['columns'])
    ->from($_GET['table'])
    ->where($_GET['where'])
;

All below statements produce 42. This is valid SQL:

SELECT `42 FROM TABLE`() FROM dual;
SELECT `=E2=A0=80` FROM `=E2=A0=80`;
SELECT * FROM "42"; -- With ANSI_QUOTES
SELECT * FROM """""";

This is valid in MySQL:

VALUES ROW(42)

This is valid in MariaDB:

VALUES (42);

This is not a valid SQL:

SELECT * FROM "\"\"";

There are also windows functions, CTE, Stored procedures, and a bunch of
new features.

--00000000000046bfa005c55e0b10--