SQL injection in plugin

[Marty0]

Hi,

could you please help me to prevent SQL injection in this case? I have this piece of code that works fine:

Code: Select all

$groups[] = "test1";
$groups[] = "test2";

$result = db_query("
	SELECT user_email, email_group, email_notifications, email_notifications_default
	FROM mantis_groups_view
	WHERE group_name IN ("'" . implode("', '", $groups) . "'")
");

if (db_num_rows($result) > 0) {
	foreach ($result as $row) {
		...
	}
}

And after edit:

Code: Select all

$groups[] = "test1";
$groups[] = "test2";
$parameters = join(', ', array_fill(0, count($groups), '?'));

$result = db_query("
	SELECT user_email, email_group, email_notifications, email_notifications_default
	FROM mantis_groups_view
	WHERE group_name IN ({$parameters})
", ["'" . implode("', '", $groups) . "'"]);

if (db_num_rows($result) > 0) {
	foreach ($result as $row) {
		...
	}
}

It throws this error:

Code: Select all

APPLICATION ERROR #401

Database query failed. Error received from database was #0: for the query: 
SELECT user_email, email_group, email_notifications, email_notifications_default
FROM mantis_groups_view
WHERE group_name IN (?, ?)


Previous non-fatal errors occurred. Page contents follow.
Input array has 1 params, does not match query: ' SELECT user_email, email_group, email_notifications, email_notifications_default FROM mantis_groups_view WHERE group_name IN (?, ?) '

Parameter in db_query should look like ['test1', 'test2'] but it doesn't work obviously.

Thank you.

[cas]

Why change a working code?

[Marty0]

Cause values in variable $group are input from user. Mentioned code is just exmaple for you. I would hate to lose any data because of it...

[cas]

as far as preventing SQL injection, there is plenty available on internet on that topic such as:
https://stackoverflow.com/questions/601 ... ion-in-php

[Marty0]

Yeah, I found this - https://stackoverflow.com/questions/920 ... n/28067015. Even though I've tried db_query function in Mantis it doesn't work. Maybe I am doing it wrong so I came here for a help.