Solved [ZNOTE AAC] - Query Usage / security

[Xevomu]

Hello!
I have doubts as to the safe use by select/insert/updates with querys in znote aac.

1)
Is it better to use a mysqli_connect or use the znote functions?

2)
What is the safest way to protect against sql-injection?

mysqli_query($connection, "UPDATE znote_accounts SET points = '$points' WHERE account_id = '$accountid' LIMIT 1");

or

mysqli_query($connection, "UPDATE znote_accounts SET points = '" . $points. "' WHERE account_id = '". $accountid . "' LIMIT 1");

or

mysql_update("UPDATE znote_accounts SET points = '$points' WHERE account_id = '$accountid' LIMIT 1;");

or

mysql_update("UPDATE znote_accounts SET points = '" . $points. "' WHERE account_id = '". $accountid . "' LIMIT 1;");

 

[Webtimize]

None of the above.

PHP: PDOStatement::bindParam - Manual

 

[Xevomu]

None of the above.

PHP: PDOStatement::bindParam - Manual

Are znoteaac's existing functions not secure for use in custom pages?
I thought I would have no problem using them.

 

[Discovery]

@Webtimize you're right. But the more simple way is develop a function to protect all queries! (at this time)

OR... you can RE-implement all your library with PDO (OOP). You'll spend more time in a "small" project in my opinion.

Time > OR < Valuation

 

[Webtimize]

@Webtimize you're right. But the more simple way is develop a function to protect all queries! (at this time)

OR... you can RE-implement all your library with PDO (OOP). You'll spend more time in a "small" project in my opinion.

Time > OR < Valuation

Znote and gesior are shit in general.

Most of the code is cluttered, unreadable and/or outdated. Most of the times error_reporting is turned off, just because the application itself is poorly designed and written from the bottom up. Going over all queries and refactor them (+ additional testing) would be a waste of time imo, since that'd be patching a sinking ship.

@ts; MyAAC by Slawkens is pretty dope, and actually being updated.
slawkens/myaac

 

[Xevomu]

I thought the znote aac was the most up-to-date and secure among the existing ones.
Thanks @Webtimize / @Discovery