[RSS Feed/News] $finder sql injection question

[XenForo]

is it safe to use direct url params in a finder based on a route?

I'm using
base/str:<slug>
to form the url in the routes page to determine the list page vs a detail page for one base category

Code:

$repo = $this->repository('My\Repo');
$finder = $repo->findMyStuff();

if(isset($params['slug']))
 {
            $finder->where('myfield', $params['slug']);
}

$viewParams = [
                    'myrow' => $finder->fetchOne(),    
]

if (!$viewParams['myrow'])
 {
          throw...

Read more

ادامه مطلب...