Search results
Prepared statements
ResourceSpace, an open-source digital asset management software, has announced that all new code must use prepared statements for any SQL execution. The new functions ps_query(), ps_array() and ps_value() replace functions sql_query(), sql_array() and sql_value() respectively.
Coding standards v2.1
The article provides coding standards for developers working on the ResourceSpace project. The standards cover various aspects of coding, including security, documentation, functionality, PHP version, MySQL strict mode, backward compatibility, file format, coding style, indentation, line length, control structures, function calls, function definitions, MySQL statements, readability of code blocks, returning early, and avoiding cross-site scripting vulnerabilities.
Injection
Injection attacks are a type of attack vector that occur when an attacker can send hostile data to an interpreter as part of a command or query, which alters the execution of that program. The most common injection flaws are cross-site scripting (XSS), SQL injections (SQLi), command injections which can lead to remote code execution (RCE) vulnerabilities, and LDAP injections.