Flaws in SQL parameter substitution

[hakito]

The MySqlCommandAdapter does a simple string substitution to replace 'Paramaters'

app/lib/Database/MySQL/MySqlCommandAdapter.php

Line 45 in 7a763d9

$query = str_replace($curParam->Name, $inClause, $query);

For example when registering a user and providing the value @salt for the last name

It creates a broken SQL statement:

INSERT INTO `users` 
	(`email`, `password`, `fname`, `lname`, `phone`, `organization`, `position`, `username`, `salt`, `timezone`, `language`, `homepageid`, `status_id`, `date_created`, `public_id`, `default_schedule_id`, `terms_date_accepted`)
VALUES
	('hacker@example.com', 'bb219ee3c6a12394e70219a7ed3894c59af05bc8', 'HackR', ''5cf29ac1'', '1', '', '', 'HackR', '5cf29ac1', 'Europe/Vienna', 'de_de', '1', '1', '2024-11-04 07:35:05', null, null, null);

This could be a security risk. Maybe you can also bypass the parameter escaping and create an SQL injection.

PDO instead?