Re: Auditing Code (security wise)
Posted by marcan on 1197321410
Quote:
Correct. XOOPS database factory automatically prevent UPDATE and DELETE query to be used in a GET request. So if you absolutely need to use on of these queries in a GET request, then you would need to use queryF().
For example, updating the counter of an article when a user gets to the page would need a queryF as the user is not accessing the article via a POST request...
But indeed, queryF needs to be used with extra care. The concept behind is that all queries that changes the database need to be within a POST request.
I don't think queryf bypasses the text sanitizer; it just allows non-SELECT queries, such as UPDATE and INSERT, to be done when processing a GET request. But I agree that queryf should only be used in special situations when it's really needed.
Correct. XOOPS database factory automatically prevent UPDATE and DELETE query to be used in a GET request. So if you absolutely need to use on of these queries in a GET request, then you would need to use queryF().
For example, updating the counter of an article when a user gets to the page would need a queryF as the user is not accessing the article via a POST request...
But indeed, queryF needs to be used with extra care. The concept behind is that all queries that changes the database need to be within a POST request.
This Post was from: https://www.impresscms.org/iforum/viewtopic.php?topic_id=618&post_id=5749