Skip to content
This repository has been archived by the owner on Nov 15, 2022. It is now read-only.

Parameter sanitisation #102

Open
dmitry84 opened this issue Apr 22, 2018 · 0 comments
Open

Parameter sanitisation #102

dmitry84 opened this issue Apr 22, 2018 · 0 comments

Comments

@dmitry84
Copy link

Hi
I can not find in the docs or code any info about the parameter sanitization before executing the query.

I see that there is a requirement to wrap parameters into the single quotes, but I'm not sure if this is sufficient to prevent SQL Injections

influx documentation suggest to supply parameres like this:
curl -G 'http://localhost:8086/query?db=mydb' --data-urlencode 'q=SELECT * FROM "mymeas" WHERE "myfield" > $field_value' --data-urlencode 'params={"field_value":30}'

I see that in the code you are using "http_build_query" to build request query, and then setParameters, but I can not find any sanitization code.

Could you explain in the doc if this is taken care or explain how should we supply parameters to the query?

Thank you in advance.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant