[TYPO3-mvc] repository chain multiple "likes"

Jochen Rau jochen.rau at typoplanet.de
Tue Dec 8 13:17:40 CET 2009


Hi.

schrieb Steffen Ritter:
> very dirty:
>
> foreach: $string =
> '$query->logicalAnd('.$string.',$query->like(nexcondition)';
>
> $query->matching(eval($string));

This is indeed very dirty and a security issue as it executes potential 
insecure strings and circumvences the quoting mechanism of the storage 
backend. eval = evil ;-).

Regards
Jochen

-- 
Every nit picked is a bug fixed



More information about the TYPO3-project-typo3v4mvc mailing list