Board Game Arena

Dear BGA Team.

Is there already implemented an SQL Injection protection, or shall I use the PHP filter_var function ?

Best Regards,

I just asked myself the same question.

It is not mentioned in any of the 3 tutorials, but the guide for game.php mentions that there could be situations where you should use escapeStringForDB( $string ) on your query parameters.

I guess an sql injection attack would only be possible if you allow an unchecked string argument in an ajax call and use that somehow in a query.

On most case input should be validated by the "getArg" method, with the "AT_*" argument types.
(http://en.doc.boardgamearena.com/Player ... on_methods)

I also cast most of them to "int" (and use php type hints) or use "enums" to prevent incorrect inputs.

But yes, I too would prefer a nice way to escape inputs, as a double precaution.

It would be even better if the BGA database API calls exposed Mysql’s prepared statements and bound variables. This means that, rather than escaping data, the data and the operational parts of the sql commands are not mixed at all. It also might possibly allow the db to cache some queries instead of parseing them every time, with a possibly positive effect on performance.

shadowphiar wrote: ↑12 August 2020, 23:06 It would be even better if the BGA database API calls exposed Mysql’s prepared statements and bound variables.

I've logged this as a suggestion in the BGA bug tracker. Feel free to give it a thumbs up if you think it's a good idea. https://boardgamearena.com/bug?id=30031