CODEWITHSUNDEEP
doctrine-orm
user1200536
user1200536

Reputation: 17

Doctrine2 FindOneBy and SQL Injection

Is this code (in Doctrine2) secured against SQL injection? Or should be $_GET['value'] sanitized? 

$ret = $entityManager->getRepository('SomeEntity')->findOneBy(array('ID' => $_GET['value']));

Thank you

Upvotes: 1

Views: 2169

Answers (1)

PatrikAkerstrand
PatrikAkerstrand

Reputation: 45721

It is secured from SQL-injection. You can find look at the source to find this out, the relevant code is in the Doctrine\ORM\Persisters-namespace, as well as Doctrine\ORM\EntityRepository and Doctrine\ORM\UnitOfWork.

Your criteria is converted into placeholders, which is also the recommended way of writing your own queries to protect against SQL-injection.

Upvotes: 5

Related Questions