I want to know few things:

  1. Is magento based on 3 tier architecture?
  2. Is it free from SQL-Injection, cross-site-scripting, CRLF injection attacks and SSI attacks?

1 Answer 1


Is magento based on 3 tier architecture?

If you're asking if Magento is designed with a 3-tier logical architecture, then yes it is, at least according to the more commonly accepted definitions of the term.

At its core, the Magento codebase (at least relatively modern releases) has been designed to separate the Presentation, Application, and Data tiers. This means, for the most part, that the base Magento system utilizes a separation of concerns where application logic isn't mixed with user interface logic or logic that controls access to the data used to power either of those tiers, although it may not always be considered an adherent to the more conventional interpretations of the MVC Design Pattern, which is often associated with 3-tier architecture, though not strictly the same thing.

Fans and Detractors of Magento may argue about how WELL it conforms to the various definitions of 3-tier architecture, but it's hard to argue that it doesn't conform at all.

If you're asking if Magento is designed / run on a 3-tier physical architecture, then the answer is MAYBE. It can be run on multiple servers, most commonly with at least 1 (or more) application servers as well as 1 (or more) database servers, allowing for horizontal scaling by increasing the number of servers at each tier based on user load and demand.

But it does not have to be and in many cases is run on a single server (or desktop / laptop, though mostly for development purposes). I'm running it on my laptop right now with php, apache, zend server, and mysql.

Is it free from SQL-Injection ,cross-site-scripting,CRLF injection attacks and SSI attacks?

Any professional who has spent any serious portion of their careers working in information technology would be hard-pressed to say this with ANY kind of authority.

Older versions of Magento are most definitely vulnerable to these kinds of attacks against it on multiple layers (Presentation, Application, and Database tiers). All software vendors stop releasing patches for older versions of their code at some point in time as it becomes unprofitable to maintain, so the exact answer you seek depends on the specific version that you're investigating.

Even recent versions of Magento CE & EE were the target of a remote execution vulnerability back in February 2015, at least that's when it was publicly disclosed and they released a patch to resolve the issue. That's not to say that there are no other vulnerabilities in the software, just that if you have ALL of the latest patches installed for Magento, your webserver(apache or nginx) your database, and all the other components of your stack, there may not be any PUBLICLY known vulnerabilities like the ones you describe.

This is true, of course, of all software. Any decent security strategy for any software you choose should be based on a defense in depth approach and even when done properly can never keep you completely safe from all risk.

In general though, Magento is used by some of the largest companies in the world (and SMB's also) and is considered to power roughly $60 billion in transactions across roughly 240,000 websites. Therefore, there is significant effort put towards identifying vulnerabilities and fixing them in a timely manner.

It would be impossible to say that it is completely risk-free of the types of attacks you mention, but if Magento, your OS, network, and supporting technological systems are well maintained and kept up to date using best practices commonly accepted by the broader IT community, then you could consider suitable for use and safe enough.

  • 1
    What a beautiful answer. Thanks for this insight and +1 from me. :-) Commented Apr 24, 2015 at 4:41
  • 1
    Perfect Answer..+1 for me..
    – liyakat
    Commented Apr 24, 2015 at 5:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.