Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Escaping Method for filter Expressions #21

Open
staabm opened this issue Apr 1, 2020 · 0 comments
Open

Escaping Method for filter Expressions #21

staabm opened this issue Apr 1, 2020 · 0 comments

Comments

@staabm
Copy link

staabm commented Apr 1, 2020

we built filter expressions like

        $searchParams = [
            'returnProperties' => true,
            'filter' => '(
                           (\'adaid\' == '.(int) $user->adaid.') AND
                           ( \'active\') 
                        )',
        ];

        $result = $this->client->send(new SearchItems($userid, $searchQuery, self::COUNT_SEARCH_ITEMS, $searchParams));

for this case we need to escape user-input so we can use it in the filter query.
atm this is easy because we just have this int here. but image we would have to pass in a string value.. how should this value be escaped for the filter-expression?

IMO the SDK should provide a escaping method, so we can use whatever variable inside the expresssion without security risks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant