2

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.

$entityId = $_GET["name"];

public function getMetaData($entityId) {
   assert('is_string($entityId)');
}

Note that using string as the assertion is deprecated since PHP 7.2.

PHP assert

4

The assert function will be called with one static parameter, the string is_string($entityId).

Thanks to the usage of single quotes, $entityId won't be interpolated, so an attacker won't be able to execute any PHP code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.