{"action":"created","issue":{"url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos/issues/1","repository_url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos","labels_url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos/issues/1/comments","events_url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos/issues/1/events","html_url":"https://github.com/RefreshMyMind/jQueryDatatablesDemos/issues/1","id":152972269,"number":1,"title":"Protection against SQL Injection...","user":{"login":"Kasara","id":7466463,"avatar_url":"https://avatars.githubusercontent.com/u/7466463?v=3","gravatar_id":"","url":"https://api.github.com/users/Kasara","html_url":"https://github.com/Kasara","followers_url":"https://api.github.com/users/Kasara/followers","following_url":"https://api.github.com/users/Kasara/following{/other_user}","gists_url":"https://api.github.com/users/Kasara/gists{/gist_id}","starred_url":"https://api.github.com/users/Kasara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kasara/subscriptions","organizations_url":"https://api.github.com/users/Kasara/orgs","repos_url":"https://api.github.com/users/Kasara/repos","events_url":"https://api.github.com/users/Kasara/events{/privacy}","received_events_url":"https://api.github.com/users/Kasara/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-05-04T09:46:39Z","updated_at":"2016-07-14T14:17:59Z","closed_at":null,"body":"Hello Charaf,\r\n\r\nthank you very much for your code example. It helps me a lot, because other examples are out of date...\r\n\r\nOne thing I would like to see in your code: input sanitizing...\r\n\r\nCurrently you use only sprintf, which protects in the case of digits, but the search-string is \"unprotected\"...\r\n\r\nI've written a little function, which you could add to your code.\r\n\r\nUsage:\r\nbefore every POST:\r\n\r\nsqlc( $_POST['order'][0]['dir'] ) // Removes special chars.\r\n\r\nsqlc( $_POST['length'], true ) // Removes everything except digits.\r\n\r\nSincerelly\r\n\r\n\r\n\r\n\r\nhttp://www.unixwiz.net/techtips/sql-injection.html\r\n\r\n```\r\n/* SQL Cleaner */\r\nfunction sqlc($string,$int=false) {\r\n    $string = str_replace(' ', '_', $string); // Replaces all spaces with underlines.\r\n    if($int===true) {\r\n        $string = preg_replace('/[^0-9]/', '', $string); // Removes everything except digits.\r\n    }\r\n    $string = preg_replace('/[^A-Za-z0-9_\\-]/', '', $string); // Removes special chars.\r\n    $string = preg_replace('/_+/', '_', $string); // Replaces multiple underlines with single one.\r\n    $string = str_replace('_', ' ', $string); // Replaces all underlines with spaces.\r\n    return $string;\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos/issues/comments/232678742","html_url":"https://github.com/RefreshMyMind/jQueryDatatablesDemos/issues/1#issuecomment-232678742","issue_url":"https://api.github.com/repos/RefreshMyMind/jQueryDatatablesDemos/issues/1","id":232678742,"user":{"login":"RefreshMyMind","id":6263938,"avatar_url":"https://avatars.githubusercontent.com/u/6263938?v=3","gravatar_id":"","url":"https://api.github.com/users/RefreshMyMind","html_url":"https://github.com/RefreshMyMind","followers_url":"https://api.github.com/users/RefreshMyMind/followers","following_url":"https://api.github.com/users/RefreshMyMind/following{/other_user}","gists_url":"https://api.github.com/users/RefreshMyMind/gists{/gist_id}","starred_url":"https://api.github.com/users/RefreshMyMind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RefreshMyMind/subscriptions","organizations_url":"https://api.github.com/users/RefreshMyMind/orgs","repos_url":"https://api.github.com/users/RefreshMyMind/repos","events_url":"https://api.github.com/users/RefreshMyMind/events{/privacy}","received_events_url":"https://api.github.com/users/RefreshMyMind/received_events","type":"User","site_admin":false},"created_at":"2016-07-14T14:17:59Z","updated_at":"2016-07-14T14:17:59Z","body":"Hi Kasara,\r\nThanks for sharing your code, This code was made to achieve the result faster admitting that you know how to secure your code, for prevention against sql injection, we have to use mysqli prepared statement, I will update the code once I have time :)"}}
{"actor":{"display_login":"RefreshMyMind"}}