I made a custom module which is actually a bit extended contact form module. I'm saving form data into database.

Is it save just to call $model->save() with values from POST? This is how I save data:

$data = $this->getRequest()->getPost('partnercontact')

$model->addData($data); $model->save()

May I suppose that Magento sanitize values before saving it into database or my module is vulnerable to SQL injection attacks?

  • what is mean by "May I suppose that Magento sanitize values before saving it into database? data"
    – Amit Bera
    Jan 6 '15 at 10:39

$this->getRequest() should return an instance of Mage_Core_Controller_Request_Http that extends Zend_Controller_Request_Http.
From what I know zend sanitizes the request values.
And the actual sql insert and update uses an instance of Varien_Db_Adapter_Pdo_Mysql that extends Zend_Db_Adapter_Pdo_Mysql. This one also should sanitize the queries.

But you can never be too careful.


You may not suppose that Magento will sanitize the input, you need to take care of that yourself.

If you target the post data directly you will be open to malicious input.

In your controller's php you want to call something like below:

$userInput = $this->getRequest()->getParam('user input element name here');

where $this is an extension of Mage_Core_Controller_Front_Action.

And if you're outputting user input back to the page, you will probably want to sanitize that using the escapeHtml() method.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.