什么时候在CakePHP中进行消毒 [英] When to do sanitization in CakePHP

问题描述

我从食谱中读取（第4.2节）

I read from the cookbook (sec. 4.2)

CakePHP已经保护您免受SQL注入，如果您使用CakePHP的ORM方法如find（）和save（））和适当的数组符号（即array（'field'=> $ value））而不是原始SQL。对于针对XSS的清理，通常更好地在数据库中保存原始HTML而不修改，并在输出/显示时清理。

CakePHP already protects you against SQL Injection if you use CakePHP's ORM methods (such as find() and save()) and proper array notation (ie. array('field' => $value)) instead of raw SQL. For sanitization against XSS its generally better to save raw HTML in database without modification and sanitize at the time of output/display.

我们确信我们从来不需要手动清理用户数据对SQL，只要我们限制的方法，如find（）和save（）？特别是，这是真的如果我直接从$ _POST而不是从$ this->数据我的数据？换句话说，假设我使用$ this-> data做一个find（）查询。那么CakePHP在编写数组$ this-> data时或者在为find（）编写查询时清除SQL？

So are we sure that we NEVER need to manually sanitize user data against SQL, provided we restrict to methods such as find() and save()? Especially, is this true if I take my data from $_POST directly instead than from $this->data? In other words suppose I do a find() query using $this->data. Then CakePHP sanitize against SQL when writing the array $this->data or when writing the query for find()?

我的第二个问题是要清理要显示的数据。是Sanitize :: html idempotent？所以，我可以在我的beforeSave（）方法中使用它，还是会打破第二次我保存beacuse它再次应用，并给出一个新的结果？

My second question is for sanitizing data to be displayed. Is Sanitize::html idempotent? So, can I use it in my beforeSave() method, or will it break the second time I save beacuse it is applied again and gives a new result?

推荐答案

关于此问题：

CakePHP在写入数组$ this-> data或写入时清除SQL查询find（）？

CakePHP sanitize against SQL when writing the array $this->data or when writing the query for find()?

Cakephp不会清除控制器中的$ this-> data，在Dispatcher :: parseParams（） http://api13.cakephp.org/view_source/dispatcher/#line-244你会看到，当$ _POST被复制到控制器数据的值不被清理。

Cakephp does not sanitize $this->data in the controller, if you check the cake code, in Dispatcher::parseParams() http://api13.cakephp.org/view_source/dispatcher/#line-244 you will see that when $_POST is copied to controller data the values are not sanitized.

但是，不推荐使用$ _POST，因为你会松动所有在使用表单助手

However, using $_POST is not recommended because you will loose all the cake's magic that you gain when using the form helper

这篇关于什么时候在CakePHP中进行消毒的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！