SQL-BIND-001

$db->setQuery('SELECT * FROM #__lms WHERE id = ' . $id)

String-concat SQL instead of bind()

Concat still “works”. It is SQL injection with extra steps. Joomla 4+ query objects support bind(). Migrations should stop interpolating.

$db->setQuery('SELECT * FROM #__lms WHERE id = ' . $id) → $query->bind() / quoteName + bind

Dies at Joomla 3 → 4J3: Works nativelyJ4: Works nativelyJ6: Works nativelyBC plugin: not applicablePatch possible — review itDatabase API

Symptoms people search

sql injection · setQuery concat · bind parameters

Replace this code

Swap $db->setQuery('SELECT * FROM #__lms WHERE id = ' . $id) for $query->bind() / quoteName + bind.

Joomla 3

Remove or stop calling this

$db->setQuery('SELECT * FROM #__lms WHERE id = ' . (int) $id);

Joomla 4 / 6

Use this instead

$query = $db->getQuery(true)
    ->select('*')
    ->from($db->quoteName('#__lms'))
    ->where($db->quoteName('id') . ' = :id')
    ->bind(':id', $id, ParameterType::INTEGER);
$db->setQuery($query);

How to fix it

  1. 1Use getQuery(true), quoteName, and bind().
  2. 2Never setQuery() a string built from request data.

Also known as

bind() · quoteName · setQuery · #__

Scan a ZIP for thisAsk Infyways to fix it

Related issues

Get in touch

Have a project in mind? Let's talk about it.

Tell us what you're building. Whether it's a new site, an online store, a mobile app, or something that needs AI under the hood, we'll get back to you within a business day.

Free consultation
No commitment, no pressure
Reply within 24 hours
Usually much faster

Prefer a direct conversation?

Request a project quote

Tell us about your project

Fill out the quick form and we'll reach out.