在codeigniter中，将URI段传递给函数是否安全？

Question

here is the URI: example.com/index.php/products/shoes/sandals/123 and here is the corresponding controller:

<?php
class Products extends CI_Controller {

    public function shoes($sandals, $id)
    {
        $this->some_DB_using_Model->getListUsing($sandals,$id)
    }
}
?> 

is it safe to send $sandals directly to the model, or should I apply a filter before sending it.

edit:

function getListUsing($p1,$p2){
     $this->db->start_cache();
     $this->db->select('a');
     $this->db->select('b');
     $this->db->select('c');
     $this->db->where('p1',$p1);
     $this->db->where('p2',$p2);
     //then return the result
}

Answer 1

It depends what the model is doing. If you're using that in a database query, then, yes you need to escape it.

If you're using CodeIgniter's active queries, it will escape stuff for you.

Answer 2

There are some limitations in URI variables like allowed chars in uri segments in config.php file, and in core, there's a function named _filter_uri($str) to sanitize the uri for malicious characters, and if you don't allow quotes or double quotes in your uri, and use the CI database drivers for SQL variable cleanup, it won't be causing any problems for your system.

For example;

$this->db->query("update table set a=? where b=?",array($a_value,$b_value));

is safe than:

$this->db->query("update table set a='".$a_value."' where b='".$b_value."'");

as you may know.

The main concerns here would be;

1. You want to show some variables to the user or not,
2. SEO related issues.

Answer 3

Call me old fashion but I still like to write my SQL statements out. With that said, I use Query Bindings so that the values are automatically escaped for me.

Answer 4

I suggest to you using sparks it'll do it all for you escaping all the data for you remember never ever trust the user inputs/ also you can use the function to escape every segment. ie

www.example.com/controllername/$item1/$item2

public function controllername ($item1,$item2)
{
  //sanitazi the data
   htmlentities($item1)
   htmlentities($item2)

//after this performed the call to your model by passing the new var or array 


}