Project

General

Profile

Actions

Feature #21169

closed

add fullQuoteStr to stdWrap

Added by Martin Holtz over 14 years ago. Updated almost 14 years ago.

Status:
Closed
Priority:
Should have
Category:
-
Target version:
-
Start date:
2009-10-01
Due date:
% Done:

0%

Estimated time:
PHP Version:
4.3
Tags:
Complexity:
Sprint Focus:

Description

(afaik) at the moment you need a userFunc to sanitze a value to be sql-injection save

  1. Example: sql-injection possible
    1 = CONTENT
    1.table = tt_content
    1.select {
    pidInList = this
    orderBy = sorting
    andWhere.cObject = TEXT
    andWhere.data = GPvar:parameter
    andWhere.wrap = title = '|'
    }
  1. how it could be:
    1 = CONTENT
    1.table = tt_content
    1.select {
    pidInList = this
    orderBy = sorting
    andWhere.cObject = TEXT
    andWhere.data = GPvar:parameter # define table name for fullQuoteStr
    andWhere.fullQuoteStr = tt_content
    andWhere.wrap = title = '|'
    }
    (issue imported from #M12094)

Files

0012094.patch (880 Bytes) 0012094.patch Administrator Admin, 2009-10-01 15:26
0012094_v2.patch (900 Bytes) 0012094_v2.patch Administrator Admin, 2009-10-01 15:39
12094_v3.patch (1006 Bytes) 12094_v3.patch Administrator Admin, 2009-10-20 21:52

Related issues 1 (0 open1 closed)

Is duplicate of TYPO3 Core - Feature #22338: Added marker in CONTENT objectClosedSteffen Kamper2010-03-29

Actions
Actions

Also available in: Atom PDF