[TYPO3-mvc] SQL-Injection orderBy

[Nikolas Hagelstein]

Hi,

> When you build a query with
> $query->setOrderings(array ( $field => DESC ));
> the variable $field is NOT stripped or escaped or anything similar by
> default. Shouldn't it be?
Imho yes, but if you use the action argument directly you should add a
validation rule to the action argument anyway.
E.g. regexp ala /(field1)|(field2)|(field3)/


Cheers,
Nikolas