sorenchr Posted January 31, 2009 Share Posted January 31, 2009 Hi, im currently using sessions for a login system. Some of the session variables are used in mysql queries. My question is, do i need to sanitize the session values before putting them in a query? As i've understood it, the session variables are solely kept on the server, meanwhile the PHPSESSID is with the user, so there shouldn't really be any need for making sure that the data in the values is valid, is there? Thanks for your time. Quote Link to comment Share on other sites More sharing options...
ToonMariner Posted January 31, 2009 Share Posted January 31, 2009 you shouldn't have to as session data can only be manipulated on the server. If you KNOW you have data in there that is to be used in a query and has characters that need escaping then obviously you should ensure that takes place. any values you store in sessions that contain any qry language like 'OR 1 = 1' is bascially down to poor application design IMO - any values in session that could open you up to security lapses are your own fault - just make sure it can't be done. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.