Skip to content

docs: warn against passing user input to orderBy() and groupBy() - #10771

Open
michalsn wants to merge 1 commit into
codeigniter4:developfrom
michalsn:docs/query-builder-warnings
Open

michalsn wants to merge 1 commit into
codeigniter4:developfrom
michalsn:docs/query-builder-warnings

Conversation

@michalsn

Copy link
Copy Markdown
Member

Description
This PR adds warnings directly to the orderBy() and groupBy() documentation explaining that field names and SQL expressions require validation of user input. Includes examples that restrict column selection to an allowlist.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@michalsn michalsn added the documentation Pull requests for documentation only label Nov 12, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Pull requests for documentation only

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants