Fix SQL Injection (Legacy & Modern) in Phalcon

Phalcon's C-extension speed doesn't make it immune to classic SQLi. Whether you're utilizing the high-level PHQL (Phalcon Query Language) or hitting the low-level DB adapter, string concatenation is an invitation for a database breach. To secure Phalcon, you must leverage the internal prepared statement engine and bound parameters.

The Vulnerable Pattern

// Vulnerable Raw SQL - Direct Concatenation
$id = $_GET['id'];
$user = $this->db->fetchOne("SELECT * FROM users WHERE id = " . $id);
// Vulnerable PHQL - String Interpolation
$email = $_POST[‘email’];
$phql = “SELECT * FROM Store\Models\Users WHERE email = ’” . $email . ”’”;
$user = $this->modelsManager->executeQuery($phql)->getFirst();

The Secure Implementation

Phalcon utilizes PDO under the hood. In the vulnerable examples, user input is baked directly into the query string, allowing an attacker to break the SQL syntax. The secure fix involves 'Bound Parameters'. By using placeholders (named like :id: or positional like ?), you separate the SQL logic from the data. The 'bindTypes' parameter provides an additional layer of security by enforcing strict type casting (e.g., ensuring an ID is always an Integer) before the query hits the database driver.

// Secure PHQL (Modern Model Approach)
$user = Users::findFirst([
    'conditions' => 'id = :id:',
    'bind'       => ['id' => $id],
    'bindTypes'  => ['id' => \Phalcon\Db\Column::BIND_PARAM_INT]
]);
// Secure Raw SQL (Legacy/Direct Adapter)
$sql    = “SELECT * FROM users WHERE email = ?”;
$result = $this->db->query($sql, [$email]);
$user   = $result->fetch();