I'm querying the database directly using the exp:query tag and filtering results on the value of a segment, is this safe?

How can I make it safe?

up vote 10 down vote accepted

No, it is not. Using segment variables (which is user input, effectively) in a query with the Query module is generally regarded as unsafe.

You should use the Active Record plugin instead.

  • 2
    If using INSERT or UPDATE then Active Record methods will escape your data, but will not XSS clean it. Therefore, all data should be run through either ee()->security->xss_clean() or ee()->input->get_post('key', TRUE) before being stored in the database. There are some great tips on the ExpressionEngine Security Guidelines page. It is also a good idea to escape your values in your query WHERE='{variable}' – John Henry Donovan Jan 30 '14 at 9:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.