mardi 1 août 2017

How to prevent SQL Injection in Laravel 5.4

I am using Laravel 5.4. I have a form where I take some inputs from user. The form variables are directly inserted into database. I want to make sure the sure does not enter anything that could harm the database. I have heard of something SQL Injection but I don't know much about it.

This is my function.

public function insert_data(Request $request)
{
     $company_details_data = ['job_id'          => $maxID, 
                              'company_id'      => $company_id,
                              'job_title'       => ucwords($request>input('job_title')),
                              'vacancy_no'    =>  $request->input('vacancy_no'),
                              'category_id'    =>  $request->input('category_id'),
                              'job_type_id'     => $request->input('job_type_id'),
                              'city_id'         => $request->input('city_id'),
                              'travel_required' => $request->input('travel_required'),
                              'other_locations' => ucwords($request->input('other_locations')),
                              'no_vacancy'      => $request->input('no_vacancy'),
                              'job_salary'      => $request->input('job_salary'),
                              'date_expiry'     => $request->input('date_expiry'),
                              'job_details'     => $request->input('job_details'),
                              'date_posted'     => date('Y-m-d'),
                              'qualification_required' => $request->input('qualification_required'),
                              'experience_required'    => $request->input('experience_required'),
                              'skills_required'        => $request->input('skills_required'),
                              'apply_guidance'         => $request->input('apply_guidance'),
                              'duty_responsibilities'  => $request->input('duty_responsibilities')
                             ];

    General_model::createrecord($company_details_data,'job_details');
}

I want to use htmlspecialchars here but I am using a rich texteditor in my form. If I use htmlspecialchars it will also change the unharmful tags like ,

,
etc. Please Help



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire