Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I thought Doctrine 2 DBAL prepared statements were safe from SQLi. But I found this confusing bit in the docs:

By default the Doctrine DBAL does no escaping. Escaping is a very tricky business to do automatically, therefore there is none by default. When you use the Doctrine DBAL as standalone, you have to take care of this yourself.

What does that mean exactly? If someone tries to inject malicious code, will the query fail (as opposed to insert escaped) because the RDBMS protects me? Or I'm not protected at all?

I'm using PostgreSQL as my RDBMS.

share|improve this question
    
You are not protected at all and you shouldn't expect to be, it's your job to secure your application. From Doctrine's security documentation: "Neither Doctrine DBAL nor ORM can prevent such attacks if you are careless as a developer. This section explains to you the problems of SQL injection and how to prevent them." (read the rest of the article for some solid practices & recommendations). –  Yannis Rizos Aug 9 '13 at 17:21
    
@YannisRizos I'm talking about types. Nowhere in those examples the author used types. But still, thanks for the link, because there he clearly states that the prepared statements' examples are secure, even though he didn't use types. –  ChocoDeveloper Aug 9 '13 at 18:28
    
Doctrine DBAL relies on PDO for prepared statements, and yes those are secure(ish) when it comes to escaping strings. Still, you really need to be a bit semi-paranoid and never trust the tools completely. Also, please edit your question to mention types explicitly. I know you mentioned them in the title, but they are easy to miss. It doesn't really make much of a difference, but it'll help potentials answerers to give you specific answers. –  Yannis Rizos Aug 9 '13 at 18:31
1  
@YannisRizos I cannot partially trust the tool. It either is secure or it isn't. So either I will have to always escape the values, or never. Doing it only some times will either be a waste of precious time, or insecure, and the resulting code will be awful. –  ChocoDeveloper Aug 9 '13 at 18:35
add comment

1 Answer

I would like to clarify whether you're just using the DBAL part of Doctrine, or all of it. From my understanding, DBAL is a "lower-level" part of Doctrine, that just focuses on communicating with the database.

If you are using Doctrine with Symfony (the most commonly used way I have seen it used), and have created the appropriate entity / repository / query builder classes, then you should not need to escape any values manually. This is because values entered using those classes would be automatically escaped using prepared statements (behind the scenes, by Doctrine).

share|improve this answer
    
I'm not using Symfony, only some of its components. I use Doctrine2's ORM, but there are some cases where you just want to run some SQL, so you use only the DBAL. So I need to know whether it's secure. Apparently it is secure when you use prepared statements. Most of the DBAL's methods use prepared statements behind the scenes. But the what the docs say about types and escaping is still kind of confusing, I don't know. –  ChocoDeveloper Sep 10 '13 at 16:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.