I'm writing a custom router for Magento. Here's a code snippet of what I'm doing in the match() method:

$pathInfo = $request->getPathInfo();
$splitPath = explode('/', $pathInfo);
$category = $splitPath[1];
$categoriesCollection->addAttributeToFilter('url_key', array('eq' => $category));

My question is this: is it safe to assume that the underlying models will take care of any SQL injection attacks etc, or should I be worrying about preventing these problems?

Many thanks for any guidance.

1 Answer 1


I think it's pretty safe to assume the values will be escaped properly to prevent SQL injection. All parameters pass through the Zend_Db_Adapter_Abstract::quoteInto() method that should make it safe.
Is somehow you find a vulnerability in this, then the issue is with Zend Framework, not Magento itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.