CODEWITHSUNDEEP
phpsecurityoop
Bendy
Bendy

Reputation: 3576

Setting object's properties directly instead of through getters/setters

I came across this article written by Google's Webmaster which recommends setting/getting object parameters directly to improve code efficiency. However, I thought that doing as suggested (below) instead of accessing an object's properties through getter/setter methods) leaves the code vulnerable to attacks?

$rover = new dog();
$rover->name = 'rover';
echo $rover->name;

Upvotes: 0

Views: 50

Answers (1)

deceze
deceze

Reputation: 522499

There is no "security" implication at all. Code isn't more or less secure in terms of attackers over the internet because it does or doesn't use setters or getters. They don't "protect" anything in terms of security. What encapsulation and access control in the form of getters/setters does is to protect you from stomping on your own feet accidentally. $rover->name = .. allows you to assign anything to the attribute any time. $rover->setName(..) allows you to do some error checking when setting a value, which you can use to nip bugs in the bud earlier. But it does not prevent bugs entirely, nor does it prevent an attacker from doing malicious things. An attacker isn't going to write code to assign something to your properties. An attacker exploits bugs in code or logic loopholes; not property assignments.

Upvotes: 4

Related Questions