{"action":"closed","issue":{"url":"https://api.github.com/repos/donaldinou/ezextrafeatures/issues/2","labels_url":"https://api.github.com/repos/donaldinou/ezextrafeatures/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/donaldinou/ezextrafeatures/issues/2/comments","events_url":"https://api.github.com/repos/donaldinou/ezextrafeatures/issues/2/events","html_url":"https://github.com/donaldinou/ezextrafeatures/issues/2","id":67600514,"number":2,"title":"[Insight] Database queries should use parameter binding - in ezextrafeatures/…/helpers/cleanhelper.php, line 49","user":{"login":"donaldinou","id":429269,"avatar_url":"https://avatars.githubusercontent.com/u/429269?v=3","gravatar_id":"","url":"https://api.github.com/users/donaldinou","html_url":"https://github.com/donaldinou","followers_url":"https://api.github.com/users/donaldinou/followers","following_url":"https://api.github.com/users/donaldinou/following{/other_user}","gists_url":"https://api.github.com/users/donaldinou/gists{/gist_id}","starred_url":"https://api.github.com/users/donaldinou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/donaldinou/subscriptions","organizations_url":"https://api.github.com/users/donaldinou/orgs","repos_url":"https://api.github.com/users/donaldinou/repos","events_url":"https://api.github.com/users/donaldinou/events{/privacy}","received_events_url":"https://api.github.com/users/donaldinou/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"donaldinou","id":429269,"avatar_url":"https://avatars.githubusercontent.com/u/429269?v=3","gravatar_id":"","url":"https://api.github.com/users/donaldinou","html_url":"https://github.com/donaldinou","followers_url":"https://api.github.com/users/donaldinou/followers","following_url":"https://api.github.com/users/donaldinou/following{/other_user}","gists_url":"https://api.github.com/users/donaldinou/gists{/gist_id}","starred_url":"https://api.github.com/users/donaldinou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/donaldinou/subscriptions","organizations_url":"https://api.github.com/users/donaldinou/orgs","repos_url":"https://api.github.com/users/donaldinou/repos","events_url":"https://api.github.com/users/donaldinou/events{/privacy}","received_events_url":"https://api.github.com/users/donaldinou/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-04-10T13:52:51Z","updated_at":"2015-04-10T13:54:01Z","closed_at":"2015-04-10T13:54:01Z","body":"**[in ezextrafeatures/classes/helpers/cleanhelper.php, line 49](https://github.com/donaldinou/ezextrafeatures/blob/0419a2030b1320e7942872dc095adb0fda2dda82/ezextrafeatures/classes/helpers/cleanhelper.php#L49)**\r\n\r\n> If provided by the user, the value of `$checkTable` may allow an SQL injection attack. Avoid concatenating parameters to SQL query strings, and use parameter binding instead.\r\n\r\n```php\r\n                if ( is_array($queryResult) && !empty($queryResult) ) {\r\n                    $destIDList = array();\r\n                    foreach ($queryResult as $key => $item) {\r\n                        $destIDList[] = $item[$destID];\r\n                    }\r\n                    $query = 'DELETE FROM '. $checkTable . ' ' .\r\n                             'WHERE '. $destID . ' IN ( ' . explode(',', $destIDList) . ' )';\r\n                    \\eZDebug::writeDebug( $query, 'sql' );\r\n                    $db->query( $query );\r\n                }\r\n            }\r\n```\r\n\r\n---------------------\r\n\r\n_Posted from [SensioLabsInsight](https://insight.sensiolabs.com/projects/c9d954f1-0a9d-4b2e-b61e-2beb969a83dc/analyses/6)_"}}