Slide 7
Slide 7 text
How to guard against it
A) Write prepared SQL
statements
B) Avoid ORMs which are
non-prepared statement
compatible
C) Escape query and input
parameters
D) Use LIMIT in SQL
queries to prevent mass
data leakage
function dbFn(\PDO $pdo, string $stdId) : IO
{
return IO::return($pdo)
->map(function ($pdo) use ($stdId) {
$stmt = $pdo->query(‘
SELECT student_name, student_id
FROM students
WHERE student_id = :stdId
’);
$stmt->bind(‘:stdId’, $stdId, \PDO::PARAM_STR);
...
})
}
function inputfn() : string
{
//state monad
return State::of(‘php://input’)
->map(‘file_get_contents’)
->flatMap(
function ($input) {
return array_map(
function ($str) {
return htmlentities($str, ENT_QUOTES);
},
$input
);
}
);
}