...
| Warning | ||
|---|---|---|
| ||
When using Hash Variable that uses URL parameter or user-inputted value in the SQL query, ensure that these hash variable(s) are escaped in the query! Make use of hash variable escape keywords, see Hash Variable - Escaping the Resultant Hash Variable. Example of VULNERABLE query: SELECT * FROM app_fd_sample_table WHERE c_value = '#requestParam.id#' To fix this, use ?sql hash variable escape: SELECT * FROM app_fd_sample_table WHERE c_value = '#requestParam.id?sql#' |
...