Search code examples
sqlzend-frameworkmethodssql-injectionzend-db

ZEND_DB_TABLE_ABSTRACT methods SQL INJECTION

Is it possible for to sql inject a ZEND_DB_TABLE_ABSTRACT method?

like for example

 $this->insert();

edit for a more clearer explanation

Post values are :

'username' = 'admin';

'password' = '1;Drop table users;'

Here is the insert statement in the controller: 

public function InsertAction() {
    $postValues =   $this->_request->getPost();
    $usersTable = new Application_Models_DbTable_Users();
    $username = $postValues['username'];
    $password = $postValues['password'];
    $data = array('username'=>$username,'password'=>$password);
    $users->insert($data);
}
Solution

  • Yes, it is possible, but in the usual uses of insert() it's not probable. Unless you are using Zend_Db_Expr, you should be safe, because insert() uses prepared statements.

    See this post from Bill Karwin for other methods and details.