I'm querying the database directly using the exp:query tag and filtering results on the value of a segment, is this safe?

How can I make it safe?

1 Answer 1


No, it is not. Using segment variables (which is user input, effectively) in a query with the Query module is generally regarded as unsafe.

You should use the Active Record plugin instead.

  • 2
    If using INSERT or UPDATE then Active Record methods will escape your data, but will not XSS clean it. Therefore, all data should be run through either ee()->security->xss_clean() or ee()->input->get_post('key', TRUE) before being stored in the database. There are some great tips on the ExpressionEngine Security Guidelines page. It is also a good idea to escape your values in your query WHERE='{variable}' Jan 30, 2014 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.