Using exp:query with WHERE = {segment_2} is it safe?

Question

I'm querying the database directly using the exp:query tag and filtering results on the value of a segment, is this safe?

How can I make it safe?

Alex Kendrick · Accepted Answer · 2014-01-30 01:45:19Z

10

No, it is not. Using segment variables (which is user input, effectively) in a query with the Query module is generally regarded as unsafe.

You should use the Active Record plugin instead.

answered Jan 29, 2014 at 22:32

Alex Kendrick♦

7,9612 gold badges26 silver badges42 bronze badges

2

If using INSERT or UPDATE then Active Record methods will escape your data, but will not XSS clean it. Therefore, all data should be run through either ee()->security->xss_clean() or ee()->input->get_post('key', TRUE) before being stored in the database. There are some great tips on the ExpressionEngine Security Guidelines page. It is also a good idea to escape your values in your query WHERE='{variable}'
– John Henry Donovan
Jan 30, 2014 at 9:52

Add a comment |

1 Answer 1