{"action":"created","issue":{"url":"https://api.github.com/repos/Mazuh/UrnaEleitoral/issues/1","labels_url":"https://api.github.com/repos/Mazuh/UrnaEleitoral/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/Mazuh/UrnaEleitoral/issues/1/comments","events_url":"https://api.github.com/repos/Mazuh/UrnaEleitoral/issues/1/events","html_url":"https://github.com/Mazuh/UrnaEleitoral/issues/1","id":109710022,"number":1,"title":"SQL Injection","user":{"login":"StefanYohansson","id":1783252,"avatar_url":"https://avatars.githubusercontent.com/u/1783252?v=3","gravatar_id":"","url":"https://api.github.com/users/StefanYohansson","html_url":"https://github.com/StefanYohansson","followers_url":"https://api.github.com/users/StefanYohansson/followers","following_url":"https://api.github.com/users/StefanYohansson/following{/other_user}","gists_url":"https://api.github.com/users/StefanYohansson/gists{/gist_id}","starred_url":"https://api.github.com/users/StefanYohansson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StefanYohansson/subscriptions","organizations_url":"https://api.github.com/users/StefanYohansson/orgs","repos_url":"https://api.github.com/users/StefanYohansson/repos","events_url":"https://api.github.com/users/StefanYohansson/events{/privacy}","received_events_url":"https://api.github.com/users/StefanYohansson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-04T22:48:56Z","updated_at":"2015-10-04T22:51:33Z","closed_at":null,"body":"O sistema ainda é muito passivel de SQL Injection.\r\nSugiro algo como:\r\n* Usar PDO ao invés de mysqli puro. A classe de \"Connection\" pode ser um **singleton** para o PDO.\r\n* Usar PDO::bindValue ou PDO::bindParam ao invés de concatenar strings.\r\n\r\nex:\r\n```\r\nEleitor.php:95\r\n\r\n$sql = \"update usuario\";\r\n$sql .= \" set chapa_votada=$this->chapa_votada, momento_voto=current_timestamp()\";\r\n$sql .= \" where id=$this->id\";\r\n```\r\ndeve ser algo como:\r\n```\r\n$statement = \"update usuario set chapa_votada=:chapa_votada, momento_voto = current_timestamp() where id=:id\"\r\n\r\n$statement->bindValue(':chapa_votada', $this->chapa_votada, PDO::PARAM_STR);\r\n$statement->bindValue(':id', $this->id, PDO::PARAM_INT);\r\n```"},"comment":{"url":"https://api.github.com/repos/Mazuh/UrnaEleitoral/issues/comments/145396255","html_url":"https://github.com/Mazuh/UrnaEleitoral/issues/1#issuecomment-145396255","issue_url":"https://api.github.com/repos/Mazuh/UrnaEleitoral/issues/1","id":145396255,"user":{"login":"YuriStyl3","id":13898077,"avatar_url":"https://avatars.githubusercontent.com/u/13898077?v=3","gravatar_id":"","url":"https://api.github.com/users/YuriStyl3","html_url":"https://github.com/YuriStyl3","followers_url":"https://api.github.com/users/YuriStyl3/followers","following_url":"https://api.github.com/users/YuriStyl3/following{/other_user}","gists_url":"https://api.github.com/users/YuriStyl3/gists{/gist_id}","starred_url":"https://api.github.com/users/YuriStyl3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YuriStyl3/subscriptions","organizations_url":"https://api.github.com/users/YuriStyl3/orgs","repos_url":"https://api.github.com/users/YuriStyl3/repos","events_url":"https://api.github.com/users/YuriStyl3/events{/privacy}","received_events_url":"https://api.github.com/users/YuriStyl3/received_events","type":"User","site_admin":false},"created_at":"2015-10-04T22:51:33Z","updated_at":"2015-10-04T22:51:33Z","body":"Obg ^.^"}}