HMGforum.com

Thanks Roberto.

This gives some insight into the subject. I think I have to read a LOT!

https://stackoverflow.com/questions/2821 ... t-involves

Rathinagiri wrote:https://stackoverflow.com/questions/2821 ... t-involves

After reading that thread, there is no so much hope

I think the combo of the two may work out.

A generic PHP script which can build a query from the necessary parameters.

var data = Querier({
table: "mytable",
columns: {"column1", "column2", "column3"},
where: {
column2: {
op: '=',
value: 'blablabla'
}
}
limit: "10"
});

In the script we can add some prefix to the table names and then build the query in the script using the available parameters.

It's really hard theme to realize security policies...

Rathinagiri wrote:I think the combo of the two may work out.
<...>

Being such a sensitive theme, IMHO, the best way to go, is to keep JMG 'neutral' about this, so the user can make the decision that consider most convenient.

IMO the best is to keep all SQL stuff away from JS, so only in PHP.

Greetings, Serge

Dear, IMHO, for security is not advisable to create the SQL statement in javascript since the database, however, is fully exposed is better to make a generic script in php for data manipulation.
Totally agree with Serge.
best regards
luis vasquez

And beware of (blind) SQL injection !
Each input must be checked, controlled and parsed before execution.

Serge

Thank you Serge. I do agree with you now. Obscurity is the starting point of security.

Best screening of user-input is done in 2 ways: Javascript on client and PHP on server.
Blind SQL injection are URL's like :
Which can cause a lot trouble! Each parameter should carefully be inspected before assuming to be OK.

Serge