Code Igniter security with insert function

2019-07-23 12:54发布

问题:

I would like to know if the following piece of code would require any more security concerning SQL injections, or not?

$this->db->insert('users', $insert_data_array);

The Code Igniter wiki says that

"Note: All values are escaped automatically producing safer queries."

Please remove my doubts.

回答1:

Nope. You shouldn't be concerned for security as long as you are using the Active Record class. It automatically escapes every query. It is even easier to build the queries with at an your application becomes cross-database compatible. The input data is checked by the Security class also, so you don't have to be worried about anything.



回答2:

Make sure you have XSS filtering enabled (you can do this in the config.php file). It filters all $_POST and $_GET variables before they're inserted into your DB.