Security Problem if not Sanitizing Data before Saving by Xpdo to a Database?

We have similar questions concerning the securitiy of formit-forms and would be very glad if anybody could help us to clarify the following
point:

We found that in formit-forms the following user-input is stored without any escaping in our database:

input --> stored
=================
\x00 --> \x00
\n --> \n
\r --> \r
\ --> \
\x1a --> \x1a

Seems that there is no escaping and we are worried if this could be a risk for mysql-injections?

Should formit2db therefore be updated with something like "mysql_real_escape_string"?

\n, \r and \ should probably be left alone. AFAIK, none of these char codes can do any harm in the database.

\x00 is the NULL hexadecimal code. Again, not really harmful, but some devs prefer to strip out any null characters before use.

\x0a is the newline hex code and should be left alone.

Hi Peter,
check the real database-field-values! You can do this e. g. by exporting the database as sql and you will see that the database-entries are escaped. If they were not escaped you would see in phpmyadmin this:



instead of this when values are escaped:



(Pay attention to the number of rows shown in your database-field in these two examples which is a good indicator for escaped and not escaped values!)

Quote from: wingnutty at Feb 07, 2013, 07:39 PM

\n, \r and \ should probably be left alone. AFAIK, none of these char codes can do any harm in the database.

But why is it always recommended to escape these tags by mysql_real_escape_string if they are not harmful?

The main purpose behind mysql_real_escape_string is to prevent SQL injections, and all of these values can "disturb" a MySQL statement so that's why they are escaped. But MODX uses xPDO, which is an extension of PDO, and makes use of parameterized queries to take care of escaping data (see xPDOObject for usage). They're escaped during building the query (to prevent SQLi) but the data itself (\, \n, etc) is stored in the database.