Avoiding SQL Injection Flaws with Prepared Statements

[wdspider]

Hi,

Is there a way I can access the underlying mysqli instance within the App_DbObject class so that I can use Prepared Statements instead of manually creating the sql strings?

Thanks

[thoun]

No you can't currently, you must use framework DB functions.
But you should check your inputs using the StringParam ( https://en.doc.boardgamearena.com/Main_ ... attributes ) so your SQL should only have values you filtered first (and most of the time you'll just use int and bool so no check necessary).