Parameter has to be filtered or escaped twice for different purposes: Once to prevent SQL injection and once more to prevent cross site scripting (XSS) attacks. The solution is to use an appropriate filter when needed. For example, just before sending plain text to the browser or mixing plain text with HTML, escape it with check_plain.

CommentFileSizeAuthor
#6 Prevent_sql_injection_with_parameter-3100809-6.patch885 byteshardik_patel_12
#2 Prevent_sql_injection_with_parameter-3100809-2.patch616 byteshardik_patel_12

Comments

Hardik_Patel_12 created an issue. See original summary.

hardik_patel_12’s picture

hardik_patel_12 commented
StatusFileSize
new Prevent_sql_injection_with_parameter-3100809-2.patch616 bytes

Kindly apply and review patch

hardik_patel_12’s picture

hardik_patel_12 commented
Status: Active » Needs review
renatog’s picture

renatog commented
Status: Needs review » Reviewed & tested by the community

Makes sense.

We'll test but really looks good

renatog’s picture

renatog commented
Status: Reviewed & tested by the community » Needs work

We get this error:

Error: Call to undefined function Drupal\modal_page\check_plain() in Drupal\modal_page\ModalPage->getModalToShow()

hardik_patel_12’s picture

hardik_patel_12 commented
Status: Needs work » Needs review
StatusFileSize
new Prevent_sql_injection_with_parameter-3100809-6.patch885 bytes

Resolved replaced check plain with Html::escape kindly review patch

renatog’s picture

renatog commented

It really looks good!

We'll test! Thanks a lot

renatog’s picture

renatog commented
Status: Needs review » Reviewed & tested by the community

Tested and really works well

renatog’s picture

renatog commented
Status: Reviewed & tested by the community » Fixed

Committed to the dev branch.

Thanks a lot!

Best,

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.