Home/ Questions/Q 7627627
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T05:29:05+00:00

I am building an obscure application which is only available after an involved sign-up

  • 0

I am building an obscure application which is only available after an involved sign-up process, so submitting malicious data should not occur often.

I use Codeigniter 2.1 to filter all POST variables. Codeigniter uses the PHP function mysql_real_escape_string among other measures to prevent a sql injection attack through POST data.

I do all my validation client-side using JavaScript. The JavaScript validation runs well. Of course, a user could use cURL or some other utility to bypass the client-side validation, but the stock PHP validation in Codeigniter should prevent SQL injection, right?

Can I do my validation client-side and trust Codeigniter to protect the database from a SQL injection attack?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is what codeigniter claims. You can find this in system/core/Security.php file

    Sanitizes data so that Cross Site Scripting Hacks can be prevented.
    This function does a fair amount of work but it is extremely thorough,
    designed to prevent even the most obscure XSS attempts. Nothing is
    ever 100% foolproof, of course, but I haven’t been able to get
    anything passed the filter.

    • 0