SQL injections... about fly HOT 5 CLOSED

Seems good do it this way:
https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

from fly.

Thanks for the reference. But we will now have to get some SQL injections for testing the prevention. The simple ones which I managed to think about are not working. The server responds with error when execution assembled absolutely correct SQL query. Maybe it's just like php has some basic protection against them as you said.
I have conceptually modified one of the UserRepo class method to use the SQL stmt preparation, but I will leave this change locally at my PC, until we discover some SQL injections. I can, however, send you a copy if you want to.

from fly.

It needs to be protected. Only mysqli doesn't protect app properly.

Consider this PHP script. You can apply this injection on any column in our DB.

require_once(__DIR__ . "/db/Db.php");
$name = "admin' OR 1=1 -- ";
$db = new Db();
var_dump($db->Select("SELECT Pass FROM Users WHERE login = '$name' "));

from fly.

I think, I have completed injection prevention for Query method (proper testing needed, did some quick tests and it passed), but unfortunately Select doesn't go that well.

from fly.

All right, it should be all done and hopefully working without any problems.
Changes pushed in 99aaf30

from fly.