josoroma wrote:
But still I am a little lost with respect to:
#1
When is necesarry to use mosMakeHtmlSafe($row); in some component.html.php?
is it better than use $value = htmlspecialchars( $value ); ?
If you have just a single variable (a string), then you should use htmlspecialchars().
mosMakeHtmlSafe() applies htmlspecialchars() to each variable of an object. Therefore you can use it best on objects, if you need to put most of the entries through htmlspecialchars() anyway.
josoroma wrote:
#2
For example, in some component class:
class myComponentClass {
var $integer = ;
var $string = ;
var $array = ;
var $boolean = ;
var $date = ;
...
Which is the best way to initialize this types of variables?
Which is the best way to sanitize before SQL statements?
Here is how I would initialize them:
Code:
var $integer = 0;
var $string = '';
var $array = null;
var $boolean = false;
var $date = ???; // Depends: empty string for date in stringformat,
// null for a datetime object, 0 (integer) for unix timestamp.
If you have a class that extends mosDBTable, and if you just use $row->load, $row->bind, $row->store etc., you don't need to do any escaping by yourself, the mosDBTable class takes care of that.
If you do SQL queries by yourself, you need to escape every single variable which you use.
Let's assume you have string variable that comes in though mosGetParam( $_POST, 'my_var' ):
Code:
$myVar = mosGetParam( $_POST, 'my_var' );
/*
* This is the important stuff: escape the string by the databases function.
* addslashes is in some (rare) circumstances not enough. That's why we first call
* stripslashes() (to get rid of the slashes from mosGetParam(), which automatically adds slashes)
* and then call $databse->getEscaped();
*/
$myVar = stripSlashes( $myVar );
$myVar = $database->getEscaped( $myVar );
$query = "SELECT * FROM #__table WHERE name = '$myVar'";
$database->setQuery( $query ); // etc...
For intergers, it's enough to call intval() before you use the variable in a query:
Code:
$myInt = intval( $myInt );
$query = "SELECT * FROM #__table WHERE some_id = $myInt";
$database->setQuery( $query ); // etc...
Does this answer your questions?
Login
Register
Rules
FAQ
The team
