{"action":"created","issue":{"url":"https://api.github.com/repos/hiddentao/squel/issues/174","labels_url":"https://api.github.com/repos/hiddentao/squel/issues/174/labels{/name}","comments_url":"https://api.github.com/repos/hiddentao/squel/issues/174/comments","events_url":"https://api.github.com/repos/hiddentao/squel/issues/174/events","html_url":"https://github.com/hiddentao/squel/issues/174","id":99509970,"number":174,"title":"SQL INJECTION ( update in MySQL)","user":{"login":"udarkness","id":13683955,"avatar_url":"https://avatars.githubusercontent.com/u/13683955?v=3","gravatar_id":"","url":"https://api.github.com/users/udarkness","html_url":"https://github.com/udarkness","followers_url":"https://api.github.com/users/udarkness/followers","following_url":"https://api.github.com/users/udarkness/following{/other_user}","gists_url":"https://api.github.com/users/udarkness/gists{/gist_id}","starred_url":"https://api.github.com/users/udarkness/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/udarkness/subscriptions","organizations_url":"https://api.github.com/users/udarkness/orgs","repos_url":"https://api.github.com/users/udarkness/repos","events_url":"https://api.github.com/users/udarkness/events{/privacy}","received_events_url":"https://api.github.com/users/udarkness/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-06T19:44:17Z","updated_at":"2015-08-18T22:04:25Z","closed_at":"2015-08-18T22:04:25Z","body":"The following leads to an injection:\r\nsql.set(\"field\", \"value'\");\r\nit results in: UPDATE table SET 'value'';\r\nmore severe: sql.set(\"field\", \"' + (SELECT count(*) FROM other_table) + '\");"},"comment":{"url":"https://api.github.com/repos/hiddentao/squel/issues/comments/132369468","html_url":"https://github.com/hiddentao/squel/issues/174#issuecomment-132369468","issue_url":"https://api.github.com/repos/hiddentao/squel/issues/174","id":132369468,"user":{"login":"hiddentao","id":266594,"avatar_url":"https://avatars.githubusercontent.com/u/266594?v=3","gravatar_id":"","url":"https://api.github.com/users/hiddentao","html_url":"https://github.com/hiddentao","followers_url":"https://api.github.com/users/hiddentao/followers","following_url":"https://api.github.com/users/hiddentao/following{/other_user}","gists_url":"https://api.github.com/users/hiddentao/gists{/gist_id}","starred_url":"https://api.github.com/users/hiddentao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hiddentao/subscriptions","organizations_url":"https://api.github.com/users/hiddentao/orgs","repos_url":"https://api.github.com/users/hiddentao/repos","events_url":"https://api.github.com/users/hiddentao/events{/privacy}","received_events_url":"https://api.github.com/users/hiddentao/received_events","type":"User","site_admin":false},"created_at":"2015-08-18T22:04:25Z","updated_at":"2015-08-18T22:04:25Z","body":"Yep, squel already allows you to build parameterized queries which you can then pass to your db driver for safe value insertion."}}