Task #78437

Refactor use of queryBuilder to use prepared statements

Added by Christian Kuhn about 3 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2016-10-26
Due date:
% Done:

100%

TYPO3 Version:
8
PHP Version:
Tags:
Complexity:
Sprint Focus:
On Location Sprint

Related issues

Related to TYPO3 Core - Bug #79077: Wrong queryBuilder used when TSconfig option clearCache_pageSiblingChildren is used Closed 2016-12-22
Related to TYPO3 Core - Bug #84022: cObj->searchWhere is broken Closed 2018-02-23

Associated revisions

Revision d478cbe9 (diff)
Added by Manuel Selbach about 3 years ago

[TASK] Refactor use of queryBuilder to use prepared statements

To remove the susceptiblity to errors of SQL injections within the core
the principle of prepared statements should be followed for all queries.
Even variables which will be casted to e.g. an integer should use
setParameter(), setParameters() or createNamedParameter().

Change-Id: I7d6d256a199ba05f75791eb01f38b3b89b421989
Resolves: #78437
Releases: master
Reviewed-on: https://review.typo3.org/50090
Tested-by: TYPO3com <>
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>

Revision 3b636451 (diff)
Added by Anja Leichsenring about 3 years ago

[FOLLOWUP][TASK] Refactor queryBuilder usage

Double usage of ->createNamedParameter() on searchWord results
in always empty result list for EM TER search action.

Resolves: #78437
Releases: master
Change-Id: I5a6f1376e538b63fc5bde43daba2e75d582fde90
Reviewed-on: https://review.typo3.org/50391
Reviewed-by: Mathias Brodala <>
Reviewed-by: Claus Due <>
Tested-by: TYPO3com <>
Tested-by: Marco Bresch <>
Reviewed-by: Marco Bresch <>
Reviewed-by: Christian Kuhn <>
Tested-by: Christian Kuhn <>

Revision 95f6be32 (diff)
Added by Markus Klein about 3 years ago

[FOLLOWUP][TASK] Refactor use of queryBuilder to use prepared statements

Fix mistakes.

Resolves: #78437
Releases: master
Change-Id: Iefe82b5c2ef0f3643c3c69cda82de0992a10dd00
Reviewed-on: https://review.typo3.org/50425
Reviewed-by: Andreas Fernandez <>
Tested-by: TYPO3com <>
Tested-by: Andreas Fernandez <>
Reviewed-by: Daniel Goerz <>
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>

Revision a65c39ae (diff)
Added by Manuel Selbach about 3 years ago

[TASK] LiveSearch: Refactor use of queryBuilder to use prepared statements

According to task #78437 queries should follow the prepared statement principle.
Thus the LiveSearch has to be refactored.

Change-Id: I301190314d6e2f86512d1f5c41bcf6991009258f
Resolves: #78578
Releases: master
Reviewed-on: https://review.typo3.org/50507
Tested-by: TYPO3com <>
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>
Reviewed-by: Andreas Fernandez <>
Tested-by: Andreas Fernandez <>

Revision 4dd2cee9 (diff)
Added by Manuel Selbach almost 3 years ago

[TASK] Refactor BackendUtility::getRecordsByField() to prepared statements

According to task #78437 queries should follow the prepared statement
principle.
Thus method BackendUtiltiy::getRecordsByField() has to be refactored
to retrieve a queryBuilder which holds the parameter assigned to e.g.
additional where clause, etc. otherwise the parameter and the dynamically
generated placeholders in the queryQuilder will be reset.

Change-Id: Id66d7b2fcfc5bcdca4d920b645c2285ded0c160a
Resolves: #78704
Releases: master
Reviewed-on: https://review.typo3.org/50664
Reviewed-by: Anja Leichsenring <>
Tested-by: Anja Leichsenring <>
Tested-by: TYPO3com <>
Reviewed-by: Susanne Moog <>
Tested-by: Susanne Moog <>

History

#1 Updated by Gerrit Code Review about 3 years ago

  • Status changed from New to Under Review

Patch set 14 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50090

#2 Updated by Gerrit Code Review about 3 years ago

Patch set 15 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50090

#3 Updated by Gerrit Code Review about 3 years ago

Patch set 16 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50090

#4 Updated by Manuel Selbach about 3 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#5 Updated by Anja Leichsenring about 3 years ago

  • Sprint Focus set to On Location Sprint

#6 Updated by Gerrit Code Review about 3 years ago

  • Status changed from Resolved to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50391

#7 Updated by Anja Leichsenring about 3 years ago

  • Status changed from Under Review to Resolved

#8 Updated by Gerrit Code Review about 3 years ago

  • Status changed from Resolved to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50425

#9 Updated by Markus Klein about 3 years ago

  • Status changed from Under Review to Resolved

#10 Updated by Georg Ringer over 1 year ago

  • Related to Bug #84022: cObj->searchWhere is broken added

#11 Updated by Benni Mack about 1 year ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF