kaissaroj / angularjs-client-php-mysql-api Goto Github PK

This suffers a from a pretty big security flaw. In using an exposed API, but not sanitizing those requests server-side, it leaves a door wide open for sql injection. The PHP should sanitize inputs and not assume that the end user is submitting data to them through the intended method. i.e.:
$name = filter_var($_REQUEST['trip'], FILTER_SANITIZE_STRING);

Also, PDO would be a little more extensible in the case someone would want to use a database other than mysql.