adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Does piwigo use prepared queries? #1026

New Issue
Closed
opened 2026-10-05 00:28:57 +02:00 by adam · 1 comment
adam commented 2026-10-05 00:28:57 +02:00
Owner
Copy link
Copy source

I posted this on the forum, but i do not think it is very active.

THIS could be me not understanding the codebase well, so it is just a question.

I use cloudflare for my CDN, and because of this, the IP address captured in the history is wrong, and i need to change the header that obtains it. sure no problem.

in functions.inc.php i find the SQL statement to insert this info. but to my surprise, the string is built from the variables by concatenation instead of prepared statements:
e.g "INSERT INTO foo (firstname, lastname, email) VALUES (?, ?, ?)" and then the pwg_query function, i expected to take an array of values to bind.

even if the pwg_query was a generic query/insert function, it could use an abstract DAO class or even an optimal param for inserts.

Now, i can see that pwg_query is called from a lot of places, and I admit i have not inspected more obvious places for SQL injection like the register page.

Although i was surprised of the lack of an obvious architecture of the code, classes, abstraction, interfaces, etc... or even MVC. but putting that aside, this software works VERY well and is really awesome, I love it

I am just worried about security with SQL injection here.

I tried looking on your forum for a question like this but could only find an unrelated question about moving to PDO, of that, I do not care.

Piwigo version: 2.10.2
PHP version: 7.3.7
MySQL version: MariaDB 10.4
Piwigo URL: https://album.victorique.moe

I posted this on the forum, but i do not think it is very active. THIS could be me not understanding the codebase well, so it is just a question. I use cloudflare for my CDN, and because of this, the IP address captured in the history is wrong, and i need to change the header that obtains it. sure no problem. in functions.inc.php i find the SQL statement to insert this info. but to my surprise, the string is built from the variables by concatenation instead of prepared statements: e.g "INSERT INTO foo (firstname, lastname, email) VALUES (?, ?, ?)" and then the pwg_query function, i expected to take an array of values to bind. even if the pwg_query was a generic query/insert function, it could use an abstract DAO class or even an optimal param for inserts. Now, i can see that pwg_query is called from a lot of places, and I admit i have not inspected more obvious places for SQL injection like the register page. Although i was surprised of the lack of an obvious architecture of the code, classes, abstraction, interfaces, etc... or even MVC. but putting that aside, this software works VERY well and is really awesome, I love it I am just worried about security with SQL injection here. I tried looking on your forum for a question like this but could only find an unrelated question about moving to PDO, of that, I do not care. Piwigo version: 2.10.2 PHP version: 7.3.7 MySQL version: MariaDB 10.4 Piwigo URL: https://album.victorique.moe <!-- github-sync-id:616657622 -->
adam closed this issue 2026-10-05 00:28:57 +02:00
adam commented 2026-10-05 00:28:58 +02:00
Author
Owner
Copy link
Copy source

The issue tracker is not a discussion forum.. also, the forum does not guarantee answers within hours.
Please be patient and see answers to your question meanwhile in https://piwigo.org/forum/viewtopic.php?id=30269
Thanks.

The issue tracker is not a discussion forum.. also, the forum does not guarantee answers within hours. Please be patient and see answers to your question meanwhile in https://piwigo.org/forum/viewtopic.php?id=30269 Thanks. <!-- github-comment-id:628613528 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1026