{"action":"opened","issue":{"url":"https://api.github.com/repos/yalit/jmjbe/issues/10","labels_url":"https://api.github.com/repos/yalit/jmjbe/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/yalit/jmjbe/issues/10/comments","events_url":"https://api.github.com/repos/yalit/jmjbe/issues/10/events","html_url":"https://github.com/yalit/jmjbe/issues/10","id":53887621,"number":10,"title":"[Insight] Database queries should use parameter binding - in src/Svm/…/Entity/BlockTitleRepository.php, line 57","user":{"login":"yalit","id":3314374,"avatar_url":"https://avatars.githubusercontent.com/u/3314374?v=3","gravatar_id":"","url":"https://api.github.com/users/yalit","html_url":"https://github.com/yalit","followers_url":"https://api.github.com/users/yalit/followers","following_url":"https://api.github.com/users/yalit/following{/other_user}","gists_url":"https://api.github.com/users/yalit/gists{/gist_id}","starred_url":"https://api.github.com/users/yalit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yalit/subscriptions","organizations_url":"https://api.github.com/users/yalit/orgs","repos_url":"https://api.github.com/users/yalit/repos","events_url":"https://api.github.com/users/yalit/events{/privacy}","received_events_url":"https://api.github.com/users/yalit/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"yalit","id":3314374,"avatar_url":"https://avatars.githubusercontent.com/u/3314374?v=3","gravatar_id":"","url":"https://api.github.com/users/yalit","html_url":"https://github.com/yalit","followers_url":"https://api.github.com/users/yalit/followers","following_url":"https://api.github.com/users/yalit/following{/other_user}","gists_url":"https://api.github.com/users/yalit/gists{/gist_id}","starred_url":"https://api.github.com/users/yalit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yalit/subscriptions","organizations_url":"https://api.github.com/users/yalit/orgs","repos_url":"https://api.github.com/users/yalit/repos","events_url":"https://api.github.com/users/yalit/events{/privacy}","received_events_url":"https://api.github.com/users/yalit/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-01-09T16:44:01Z","updated_at":"2015-01-09T16:44:01Z","closed_at":null,"body":"**[in src/Svm/BlocksBundle/Entity/BlockTitleRepository.php, line 57](https://github.com/yalit/jmjbe/blob/f7fa694fe07f1b89658f33db1492fc9c022c5f3e/src/Svm/BlocksBundle/Entity/BlockTitleRepository.php#L57)**\r\n\r\n> If provided by the user, the value of `$conditions` may allow an SQL injection attack. Avoid concatenating parameters to SQL query strings, and use parameter binding instead.\r\n\r\n```php\r\n            $conditions .= \"e.\".$k.\" = '\".$w.\"'\";            \r\n        }\r\n        return $this->getEntityManager()\r\n            ->createQuery(' SELECT e\r\n                          FROM SvmBlocksBundle:BlockTitle e\r\n                          '.$conditions.'\r\n                          ')\r\n            ->setFirstResult($options['first'])\r\n            ->setMaxResults($options['max'])\r\n            ->getResult();\r\n    }\r\n```\r\n\r\n---------------------\r\n\r\n_Posted from [SensioLabsInsight](https://insight.sensiolabs.com/projects/ba157280-12d8-4d7c-83f6-15b9259e460d/analyses/5)_"}}