Template:SQL injection alert
From mediawiki.org
Warning: The code or configuration described here poses a major security risk.
Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things.
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql
Site administrators: You are advised against using it until this security issue is resolved.
Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things.
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql
- Description
- Adds an alert box describing a SQL injection vulnerability in including Extension page. Also adds including page to Category:Extensions with SQL injection vulnerabilities
- If your extension was tagged with this template please read
- For extension developers and extension users: SQL injection
- Specifically for extension developers: Security for developers
- Example
{{SQL injection alert|~~~~}}
- Creates
Warning: The code or configuration described here poses a major security risk.
Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things. Daniel Friesen (Dantman) 02:03, 2 January 2012 (UTC)
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql Daniel Friesen (Dantman) 02:03, 2 January 2012 (UTC)
Site administrators: You are advised against using it until this security issue is resolved.
Problem: Vulnerable to SQL injection attacks, because it passes user input directly into SQL commands. This may lead to user accounts being hijacked, wiki content being compromised, private data being leaked, malware being injected, and the entire wiki content being erased, among other things. Daniel Friesen (Dantman) 02:03, 2 January 2012 (UTC)
Solution: make proper use of MediaWiki's database class instead of concatenating raw sql Daniel Friesen (Dantman) 02:03, 2 January 2012 (UTC)
The above documentation is transcluded from Template:SQL injection alert/doc. (edit | history)
Editors can experiment in this template’s sandbox (create | mirror) and testcases (create) pages.
Please add categories to the /doc subpage. Subpages of this template.
Editors can experiment in this template’s sandbox (create | mirror) and testcases (create) pages.
Please add categories to the /doc subpage. Subpages of this template.