Parameter has to be filtered or escaped twice for different purposes: Once to prevent SQL injection and once more to prevent cross site scripting (XSS) attacks. The solution is to use an appropriate filter when needed. For example, just before sending plain text to the browser or mixing plain text with HTML, escape it with check_plain.

CommentFileSizeAuthor
#6 Prevent_sql_injection_with_parameter-3100809-6.patch885 bytesHardik_Patel_12
#2 Prevent_sql_injection_with_parameter-3100809-2.patch616 bytesHardik_Patel_12
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Hardik_Patel_12 created an issue. See original summary.

Hardik_Patel_12’s picture

Hardik_Patel_12 CreditAttribution: Hardik_Patel_12 at QED42 commented
FileSize
Prevent_sql_injection_with_parameter-3100809-2.patch616 bytes

Kindly apply and review patch

Hardik_Patel_12’s picture

Hardik_Patel_12 CreditAttribution: Hardik_Patel_12 at QED42 commented
Status: Active » Needs review
renatog’s picture

renatog
Location Campinas
CreditAttribution: renatog at CI&T commented
Status: Needs review » Reviewed & tested by the community

Makes sense.

We'll test but really looks good

renatog’s picture

renatog
Location Campinas
CreditAttribution: renatog at CI&T commented
Status: Reviewed & tested by the community » Needs work

We get this error:

Error: Call to undefined function Drupal\modal_page\check_plain() in Drupal\modal_page\ModalPage->getModalToShow()

Hardik_Patel_12’s picture

Hardik_Patel_12 CreditAttribution: Hardik_Patel_12 at QED42 commented
Status: Needs work » Needs review
FileSize
Prevent_sql_injection_with_parameter-3100809-6.patch885 bytes

Resolved replaced check plain with Html::escape kindly review patch

renatog’s picture

renatog
Location Campinas
CreditAttribution: renatog at CI&T commented

It really looks good!

We'll test! Thanks a lot

renatog’s picture

renatog
Location Campinas
CreditAttribution: renatog at CI&T commented
Status: Needs review » Reviewed & tested by the community

Tested and really works well

renatog’s picture

renatog
Location Campinas
CreditAttribution: renatog at CI&T commented
Status: Reviewed & tested by the community » Fixed

Committed to the dev branch.

Thanks a lot!

Best,

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.