Use Prepared statements instead of concatenating user-supplied values about equalify HOT 5 CLOSED

I'm happy to say this issue is closed! And Instant Message Freedom Inc. is receiving $255.55. Way to go @jrchamp!

from equalify.

o since, Paypal tells me to increase the impact by sharing the link, I probably should share the donate link: https://paypal.com/donate/?hosted_button_id=ZDJ3L88KQQ5LS&source=url

from equalify.

Glad it was helpful! The third piece about SQL injections is the key motivation for me. There are definitely performance benefits that are possible though when the prepared statement can be reused with multiple sets of inputs.

from equalify.

@ebertucc added a few more related docs:

• https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
• https://www.php.net/manual/en/mysqli.query.php

I'm elevating this enhancement to a bug.

Fix coming!

from equalify.

I'm adding a bounty to resolve this issue, since I'm busy building new features:

$255.55 will be paid to you if your resolution to this issue is merged.

To participate:

• Convert every SQL query in the main branch to prepared statements.
• Submit a pull request w/ your Venmo user or link to a donation page.
• $255.55 if your update is merged into main.

from equalify.