J3 Issue ?
avatar Simon-Davies
Simon-Davies
17 May 2017

In the light of the recent SQL Injection vulnerability in Joomla 3.7 would it not be a good idea to rewrite Joomla's code to use PDO and parameterised queries?

I know this would be a lot of work but I'm willing to help.

avatar Simon-Davies Simon-Davies - open - 17 May 2017
avatar joomla-cms-bot joomla-cms-bot - change - 17 May 2017
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - labeled - 17 May 2017
avatar mbabker
mbabker - comment - 17 May 2017

It's not possible during 3.x, ext/mysql doesn't support prepared statements and it's not worth it to emulate this, especially as we're dropping it in 4.0.

As for the rest of the package, the bulk of the work is already done but the implementations are more reliant on each driver's configuration so right now I'm not sure even with all the work ported over we could write SQL and handle parameterized queries all that well without having an extra layer of string processing in our query processing code.

This is the stuff that needs to be ported over:

avatar franz-wohlkoenig franz-wohlkoenig - change - 18 May 2017
Priority Medium Low
Status New Discussion
avatar franz-wohlkoenig franz-wohlkoenig - change - 18 May 2017
Category SQL
avatar SniperSister
SniperSister - comment - 18 May 2017

Count me in here too, would love to see that happen!

avatar mbabker
mbabker - comment - 31 May 2017

#16402 would make use of the Framework database package in 4.0. Includes making prepared statement support available and PDO PostgreSQL connections.

avatar brianteeman brianteeman - labeled - 25 Mar 2018
avatar brianteeman
brianteeman - comment - 9 Apr 2018

closed as this work is in progress as mentioned above.

avatar brianteeman brianteeman - change - 9 Apr 2018
Status Discussion Closed
Closed_Date 0000-00-00 00:00:00 2018-04-09 15:27:56
Closed_By brianteeman
Labels Added: J3 Issue
avatar brianteeman brianteeman - close - 9 Apr 2018

Add a Comment

Login with GitHub to post a comment