2

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php.

$entityId = $_GET["name"];

public function getMetaData($entityId) {
   assert('is_string($entityId)');
}

Note that using string as the assertion is deprecated since PHP 7.2.

PHP assert

1 Answer 1

4

The assert function will be called with one static parameter, the string is_string($entityId).

Thanks to the usage of single quotes, $entityId won't be interpolated, so an attacker won't be able to execute any PHP code.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .