I am working on a project where I am trying to check some validations but I find a risk of ‘product_id’ parameter is not properly sanitized upon submission to the index.php
script, which can disclose the software’s installation path resulting in a loss of confidentiality.
so after checking the format of product_id of products, its only in numeric but is there any possibility that the format may be alphanumeric and if yes then what exactly will be the behavior.
2
Answers
Don’t change it’s data type because it’s relation exists in 5-6 tables, SO better create a new field for it’s alphanumeric Id and control it using php..
The product id is the foriegn key for 5-6 tables eg) product option contains the product id as referance so please dont