Class: sql_whereclause_blacklist_checker
Source Location: /security/db/class.sql_whereclause_blacklist_checker.inc
Class sql_whereclause_blacklist_checker
Class Overview
|
A blacklist checker that blacklists certain SQL parts, given that it always operates on an SQL where clause as given by atkselector.
Note that, like all blacklists, this is not a permanent solution. Blacklists are losing battles, ATK should simply not pass SQL in the URL. However, as we improve ATK, for backwardscompatibility, we blacklist what SQL we know to be evil in where clauses.
Located in /security/db/class.sql_whereclause_blacklist_checker.inc [line 34]
Wiki documentation
|
Properties
|
Methods
|
Property Summary
| array |
$_disallowed |
Blacklisted parts of SQL for where clause |
Method Summary
| sql_whereclause_blacklist_checker |
__construct() |
Create a new checker object for a given WHERE clause |
| unknown |
isSafe() |
Is the given WHERE clause 'safe' (no blacklisted SQL in it)? |
Properties
Blacklisted parts of SQL for where clause
API Tags:
The WHERE clause to filter.
API Tags:
Methods
sql_whereclause_blacklist_checker __construct(
string
$whereclause
)
|
|
Create a new checker object for a given WHERE clause
Parameters:
API Tags:
Is the given WHERE clause 'safe' (no blacklisted SQL in it)?
Parse the WHERE clause character by character and look behind to find blacklisted SQL. Exception for when we're in 'quote' mode (entering a string).
API Tags: