{"action":"created","issue":{"url":"https://api.github.com/repos/nova-framework/framework/issues/894","repository_url":"https://api.github.com/repos/nova-framework/framework","labels_url":"https://api.github.com/repos/nova-framework/framework/issues/894/labels{/name}","comments_url":"https://api.github.com/repos/nova-framework/framework/issues/894/comments","events_url":"https://api.github.com/repos/nova-framework/framework/issues/894/events","html_url":"https://github.com/nova-framework/framework/issues/894","id":157363629,"number":894,"title":"Bindings followup issue #893","user":{"login":"jimgwhit","id":7936192,"avatar_url":"https://avatars.githubusercontent.com/u/7936192?v=3","gravatar_id":"","url":"https://api.github.com/users/jimgwhit","html_url":"https://github.com/jimgwhit","followers_url":"https://api.github.com/users/jimgwhit/followers","following_url":"https://api.github.com/users/jimgwhit/following{/other_user}","gists_url":"https://api.github.com/users/jimgwhit/gists{/gist_id}","starred_url":"https://api.github.com/users/jimgwhit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimgwhit/subscriptions","organizations_url":"https://api.github.com/users/jimgwhit/orgs","repos_url":"https://api.github.com/users/jimgwhit/repos","events_url":"https://api.github.com/users/jimgwhit/events{/privacy}","received_events_url":"https://api.github.com/users/jimgwhit/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-29T00:57:00Z","updated_at":"2016-05-29T01:13:53Z","closed_at":null,"body":"@LuckyCyborg Right from php manual your link.\r\n~~~\r\nExecute the prepared statement. If the prepared statement included parameter markers, you must either:\r\n\r\ncall PDOStatement::bindParam() and/or PDOStatement::bindValue() to bind either variables or values (respectively) to the parameter markers. Bound variables pass their value as input and receive the output value, if any, of their associated parameter markers\r\n~~~\r\nThe new api is not secure without proper bindings. You may be good programmer but I know my database stuff. Do not delete this until issue is addressed.  \r\n\r\nfrom manual, proper secure binding\r\n~~~\r\n<?php\r\n/* Execute a prepared statement by binding PHP variables */\r\n$calories = 150;\r\n$colour = 'red';\r\n$sth = $dbh->prepare('SELECT name, colour, calories\r\n    FROM fruit\r\n    WHERE calories < :calories AND colour = :colour');\r\n$sth->bindValue(':calories', $calories, PDO::PARAM_INT);\r\n$sth->bindValue(':colour', $colour, PDO::PARAM_STR);\r\n$sth->execute();\r\n?>\r\n~~~\r\nYou prepare then bind."},"comment":{"url":"https://api.github.com/repos/nova-framework/framework/issues/comments/222337123","html_url":"https://github.com/nova-framework/framework/issues/894#issuecomment-222337123","issue_url":"https://api.github.com/repos/nova-framework/framework/issues/894","id":222337123,"user":{"login":"LuckyCyborg","id":13488485,"avatar_url":"https://avatars.githubusercontent.com/u/13488485?v=3","gravatar_id":"","url":"https://api.github.com/users/LuckyCyborg","html_url":"https://github.com/LuckyCyborg","followers_url":"https://api.github.com/users/LuckyCyborg/followers","following_url":"https://api.github.com/users/LuckyCyborg/following{/other_user}","gists_url":"https://api.github.com/users/LuckyCyborg/gists{/gist_id}","starred_url":"https://api.github.com/users/LuckyCyborg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LuckyCyborg/subscriptions","organizations_url":"https://api.github.com/users/LuckyCyborg/orgs","repos_url":"https://api.github.com/users/LuckyCyborg/repos","events_url":"https://api.github.com/users/LuckyCyborg/events{/privacy}","received_events_url":"https://api.github.com/users/LuckyCyborg/received_events","type":"User","site_admin":false},"created_at":"2016-05-29T01:13:53Z","updated_at":"2016-05-29T01:13:53Z","body":"@jimgwhit You Jim, you consider that **you are better programmer than me** or those who develop CodeIgniter, CakePHP or Laravel?\r\n\r\nIn Database API you should go with QueryBuilder or Models for processing. Connection API do not offer other facilities that safe executing SQL commands."}}
{"actor":{"display_login":"LuckyCyborg"}}