new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

application_security/sql_injection

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Insecure DQL query concatenation vulnerable to SQL injection

SQL Injection vulnerability occurs when user input is directly concatenated into a DQL query string without using parameterized queries. Example of insecure code: $dql = "SELECT p FROM App\Entity\Post p WHERE p.id = " . $id . ";";

SQL injection protection with Doctrine entity repository

Use Doctrine entity repository built-in methods to protect against SQL injection. Example: $post = $em->getRepository(Post::class)->findOneBy(['id' => $id]); This method automatically handles parameterization.

SQL injection protection with Doctrine DQL parameters

Use parameterized queries in Doctrine DQL by creating the query and then setting parameters separately. Example: $query = $em->createQuery("SELECT p FROM App\Entity\Post p WHERE p.id = :id"); $query->setParameter('id', $id); $post = $query->getSingleResult();

SQL injection protection with DBAL Query Builder

Use Doctrine DBAL Query Builder with parameter binding to prevent SQL injection. Example: $qb = $em->createQueryBuilder(); $post = $qb->select('p')->from('posts','p')->where('id = :id')->setParameter('id', $id)->getQuery()->getSingleResult();

Give your agent this brain