CodeIgniter - query binding "order by"

Question

In my CodeIgniter, I'm binding my query to a set of variables.

$q = "SELECT * FROM my_table WHERE name=? ORDER BY ?"; $name = $this->input->get("name"); $order_by = $this->input->get("order_by"); $this->db->query($q, array($name, $order_by));

But "order_by" isn't working properly. I've searched through, but I'm not sure how to "sanitize" the "order by" clause.

Dino Babu · Accepted Answer · 2013-05-08 08:39:31Z

2

try this way,

$order_by_arr = array('name', 'age', 'date'); if (!in_array($order_by, $order_by_arr)) { $order_by = 'name'; } // now u can use $order_by. its safe :) ...

answered May 8, 2013 at 8:39

Dino Babu

5,8093 gold badges26 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

ericbae Over a year ago

Hm. Makes sense, but seems kind of hacky!

ericbae Over a year ago

shouldn't it be if(in_array) instead of if(!in_array)?

Dino Babu Over a year ago

yea. its up to u. i just said an idea. :)

ericbae Over a year ago

just tried it and does work wonderfully. :) love to hear more thoughts from others too.

Community · Accepted Answer · 2017-05-23 11:55:58Z

1

$order_by = $this->db->escape_like_str($this->input->get("order_by")); $q = "SELECT * FROM my_table WHERE name=? ORDER BY {$order_by}"; $name = $this->input->get("name"); $this->db->query($q, array($name));

refer this link, this suits your requirement best.

Query Binding in codeigniter

edited May 23, 2017 at 11:55

CommunityBot

11 silver badge

answered May 8, 2013 at 8:22

Maulik Vora

2,5845 gold badges28 silver badges49 bronze badges

3 Comments

ericbae Over a year ago

That does not sanitize the value of $order_by - does not prevent SQL injection on the order_by variable.

Maulik Vora Over a year ago

I think it is secure at an extent. ellislab.com/codeigniter/user-guide/database/queries.html

ericbae Over a year ago

I run the above query via URL as follows - myapp/get_table?name=table_name&order_by=id - now, I can do a following SQL injection myapp/get_table?name=table_name&order_by=id;select * from users - and the injected query will return results - so I don't think it's secure.

Collectives™ on Stack Overflow

CodeIgniter - query binding "order by"

2 Answers 2

4 Comments

3 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

3 Comments

Linked

Related