I made a breakthrough in my MVC application

Posted on August 12, 2019387 views2 min read

Alright so this was actually a week ago (August 4th, 2019), but I didn't have the time and chance to write this post. I finally am able to restrict people from writing in SQL Injection. This will prevent people from making it worse for themselves. In my restriction, I am able to restrict people from putting in raw variables into the SQL query. Here are examples of what I've restricted.

// First example
$sql = 'SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = $id';

// Second example
$sql = "SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = $id";

// Third example
$sql = "SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = '$id'";

// Fourth example
$sql = 'SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = ' . $id;

// Fifth example
$sql = 'SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = ' . $id . '';

// Sixth example
$sql = "SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = " . $id;

// Seventh example
$sql = "SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = " . $id . "";

// Eighth example
$sql = "SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = " . $id . '';

// Ninth example
$sql = 'SELECT id, name FROM ' . DB_PREFIX . 'users WHERE id = ' . $id . "";

All of these examples are restricted and you can no longer do anything like this. You should never in the first place be able to do anything like this. This is just asking for trouble. So I have restricted this so people can start writing actual clean code.

You will also receive these error pages if you don't remove the bad coding practices from your code.