[TYPO3-mvc] repository chain multiple "likes"
Jochen Rau
jochen.rau at typoplanet.de
Tue Dec 8 13:17:40 CET 2009
Hi.
schrieb Steffen Ritter:
> very dirty:
>
> foreach: $string =
> '$query->logicalAnd('.$string.',$query->like(nexcondition)';
>
> $query->matching(eval($string));
This is indeed very dirty and a security issue as it executes potential
insecure strings and circumvences the quoting mechanism of the storage
backend. eval = evil ;-).
Regards
Jochen
--
Every nit picked is a bug fixed
More information about the TYPO3-project-typo3v4mvc
mailing list