In the light of the recent SQL Injection vulnerability in Joomla 3.7 would it not be a good idea to rewrite Joomla's code to use PDO and parameterised queries?
I know this would be a lot of work but I'm willing to help.
Labels |
Added:
?
|
Priority | Medium | ⇒ | Low |
Status | New | ⇒ | Discussion |
Category | ⇒ | SQL |
Count me in here too, would love to see that happen!
closed as this work is in progress as mentioned above.
Status | Discussion | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2018-04-09 15:27:56 |
Closed_By | ⇒ | brianteeman | |
Labels |
Added:
J3 Issue
|
It's not possible during 3.x,
ext/mysql
doesn't support prepared statements and it's not worth it to emulate this, especially as we're dropping it in 4.0.As for the rest of the package, the bulk of the work is already done but the implementations are more reliant on each driver's configuration so right now I'm not sure even with all the work ported over we could write SQL and handle parameterized queries all that well without having an extra layer of string processing in our query processing code.
This is the stuff that needs to be ported over:
ext/pgsql
support