Secure coding guidelines - Revision history

Cmb: Some markup, capitalization changes and a URL correction.

2022-10-15T16:36:10Z

Some markup, capitalization changes and a URL correction.

Show changes

M-b-o: Marked this version for translation

2020-04-09T22:15:10Z

Marked this version for translation

Show changes

Wilsonge: Fix link to JRequest

2020-04-08T22:56:35Z

Fix link to JRequest

← Older revision		Revision as of 22:56, 8 April 2020
Line 4:		Line 4:

	==Getting data from the request==		==Getting data from the request==
	{{JVer\|3.x}} Starting with Joomla version 3.0, [[Retrieving_request_data_using_JInput\|JInput]] should be used instead of [[JRequest]].		{{JVer\|3.x}} Starting with Joomla version 3.0, [[Retrieving_request_data_using_JInput\|JInput]] should be used instead of [https://api.joomla.org/cms-3/classes/JRequest.html JRequest].

Wilsonge: Add note on security for array filter

2020-03-30T20:59:06Z

Add note on security for array filter

← Older revision		Revision as of 20:59, 30 March 2020
Line 168:		Line 168:
	\| STRING \|\| Equivalent to [[Retrieving_request_data_using_JInput#Getting_Values\|JInput->getString]].		\| STRING \|\| Equivalent to [[Retrieving_request_data_using_JInput#Getting_Values\|JInput->getString]].
	\|-		\|-
	\| ARRAY \|\| Source is not filtered but is cast to array type.		\| ARRAY \|\| Source is not filtered but is cast to array type. When using this type you should use JFilterInput directly to filter the values in your data array.
	\|-		\|-
	\| HTML \|\| A sanitised string. Equivalent to [[Retrieving_request_data_using_JInput#Getting_Values\|JInput->getHtml]].		\| HTML \|\| A sanitised string. Equivalent to [[Retrieving_request_data_using_JInput#Getting_Values\|JInput->getHtml]].

Blancanieve at 16:47, 18 March 2020

2020-03-18T16:47:08Z

← Older revision		Revision as of 16:47, 18 March 2020
Line 1:		Line 1:
			<noinclude><languages /></noinclude>
			<translate>
	Joomla includes many features that help with the task of securing applications and extensions built on it. You should always use these features if at all possible as they have been tried and tested by the many eyes of the developer community and any updates that might conceivably be required in the future will be automatically available whenever a Joomla update is applied. What follows is a description of best practice in using the Joomla API to ensure that your extensions are as secure as possible.		Joomla includes many features that help with the task of securing applications and extensions built on it. You should always use these features if at all possible as they have been tried and tested by the many eyes of the developer community and any updates that might conceivably be required in the future will be automatically available whenever a Joomla update is applied. What follows is a description of best practice in using the Joomla API to ensure that your extensions are as secure as possible.

Line 381:		Line 383:
	This method removes sequences of two or more "." characters and any character that is not alphabetic, numeric or a dot, dash or underscore character. If there is a leading dot then that is removed too.		This method removes sequences of two or more "." characters and any character that is not alphabetic, numeric or a dot, dash or underscore character. If there is a leading dot then that is removed too.
	[[Category:Development]][[Category:Security]]		[[Category:Development]][[Category:Security]]
			</translate>

Dragnob: /* Secure strings */ Fixed hyperlinks for JFactory, JDatabase-quote, and JDatabase-escape

2019-10-19T02:18:47Z

Secure strings: Fixed hyperlinks for JFactory, JDatabase-quote, and JDatabase-escape

← Older revision		Revision as of 02:18, 19 October 2019
Line 279:		Line 279:

	===Secure strings===		===Secure strings===
	In the examples that follow it is assumed that $db is an instance of a Joomla database object. This can always be obtained from [[JFactory]] using		In the examples that follow it is assumed that $db is an instance of a Joomla database object. This can always be obtained from [https://docs.joomla.org/Using_the_JFactory_class JFactory] using
	<source lang="php">		<source lang="php">
	$db = JFactory::getDBO();		$db = JFactory::getDBO();
	</source>		</source>
	Strings should always be escaped before being used in an SQL statement. This is actually very simple as the [~~[JDatabase~~/~~quote\|~~JDatabase->quote]] method escapes everything for you. You can also use the [~~[JDatabase~~/~~escape\|~~JDatabase->escape]] method directly. The following statements are equivalent:		Strings should always be escaped before being used in an SQL statement. This is actually very simple as the [https://api.joomla.org/cms-3/classes/JDatabaseQuery.html#method_quote JDatabase->quote] method escapes everything for you. You can also use the [https://api.joomla.org/cms-3/classes/JDatabaseQuery.html#method_escape JDatabase->escape] method directly. The following statements are equivalent:
	<source lang="php">		<source lang="php">
	$query = 'SELECT * FROM #__table WHERE `field` = ' . $db->quote( $db->escape( $field ), false );		$query = 'SELECT * FROM #__table WHERE `field` = ' . $db->quote( $db->escape( $field ), false );
Line 289:		Line 289:
	$query = 'SELECT * FROM #__table WHERE `field` = ' . $db->quote( $field );		$query = 'SELECT * FROM #__table WHERE `field` = ' . $db->quote( $field );
	</source>		</source>

	===Secure on search===		===Secure on search===
	Special attention should be paid to LIKE clauses which contain the % wildcard character as these require special escaping in order to avoid possible denial of service attacks. LIKE clauses can be handled like this:		Special attention should be paid to LIKE clauses which contain the % wildcard character as these require special escaping in order to avoid possible denial of service attacks. LIKE clauses can be handled like this:

Mickmackusa: /* Secure arrays of integers */ $catId is NOT modified by reference; the return value must overwrite the input variable. https://joomla.stackexchange.com/a/22898/12352

2019-10-19T01:59:10Z

Secure arrays of integers: $catId is NOT modified by reference; the return value must overwrite the input variable. https://joomla.stackexchange.com/a/22898/12352

← Older revision		Revision as of 01:59, 19 October 2019
Line 318:		Line 318:
	<source lang="php">		<source lang="php">
	...		...
	JArrayHelper::toInteger($catId);		$catId = JArrayHelper::toInteger($catId);
	$query->where($db->quoteName('x.category_id') . ' IN (' . implode(',', $catId) . ')');		$query->where($db->quoteName('x.category_id') . ' IN (' . implode(',', $catId) . ')');
	</source>		</source>

Mickmackusa: /* Short aliases of Quote and QuoteName */ fixed syntax error regarding property arrow

2019-10-19T01:49:37Z

Short aliases of Quote and QuoteName: fixed syntax error regarding property arrow

← Older revision		Revision as of 01:49, 19 October 2019
Line 325:		Line 325:
	Shorter alternatives to the quote methods may also be used. The following statements are equivalent:		Shorter alternatives to the quote methods may also be used. The following statements are equivalent:
	<source lang="php">		<source lang="php">
	$query = 'SELECT * FROM #__table WHERE ' . $db->quoteName( $field-name ) . '=' . $db->quote( $field-value );		$query = 'SELECT * FROM #__table WHERE ' . $db->quoteName( $field->name ) . '=' . $db->quote( $field->value );
	$query = 'SELECT * FROM #__table WHERE ' . $db->qn( $field-name ) . '=' . $db->q( $field-value );		$query = 'SELECT * FROM #__table WHERE ' . $db->qn( $field->name ) . '=' . $db->q( $field->value );
	</source>		</source>

Mickmackusa: /* Secure field names */ Fixed syntax error, property arrow was incorrect

2019-10-19T01:37:02Z

Secure field names: Fixed syntax error, property arrow was incorrect

← Older revision		Revision as of 01:37, 19 October 2019
Line 310:		Line 310:
	In the comparatively rare case where a field name is a variable, that should also be quoted using an API call:		In the comparatively rare case where a field name is a variable, that should also be quoted using an API call:
	<source lang="php">		<source lang="php">
	$query = 'SELECT * FROM #__table WHERE ' . $db->quoteName( $field-name ) . '=' . $db->quote( $field-value );		$query = 'SELECT * FROM #__table WHERE ' . $db->quoteName( $field->name ) . '=' . $db->quote( $field->value );
	</source>		</source>

Alexandreelise: /* Secure on search */

2019-10-13T21:27:00Z

Secure on search

← Older revision		Revision as of 21:27, 13 October 2019
Line 293:		Line 293:
	<source lang="php">		<source lang="php">
	// Construct the search term by escaping the user-supplied string and, if required, adding the % wildcard characters manually.		// Construct the search term by escaping the user-supplied string and, if required, adding the % wildcard characters manually.
	$search = '%' . $db->escape( $search, true ) . '%' );		$search = '%' . $db->escape( $search, true ) . '%';

	// Construct the SQL query, being careful to suppress the default behaviour of Quote so as to prevent double-escaping.		// Construct the SQL query, being careful to suppress the default behaviour of Quote so as to prevent double-escaping.