How do I avoid SQL injection when using the DBManagerFactory? Is there any way to use parametrized queries?

Question

The DBManager - http://support.sugarcrm.com/Documentation/Sugar_Developer/Sugar_Developer_Guide_7.7/Data_Framework/Database/DBManagerFac… - is indispensable for querying the database.

My favorite way of preventing SQL injection is binding variables, so the query and the variables get sent to the database. In PHP I'd use PDO with parameterized queries (using bindParam()). This thread recommends it for all sorts of reasons - appsec - SQL injection -- why isn't escape quotes safe anymore? - Information Security Stack Exchange .

I'm pretty sure PDO is being used in the background in the DBManager. Is there any way to use parameterized queries using the DBManager?

Alan Apter · Accepted Answer

This was written in 2016. I'm answering my own question here, but for anyone finding this post since then, as of 7.9, SugarCRM now supports prepared statements, this is the relevant part of the documentation (8.2): - http://support.sugarcrm.com/Documentation/Sugar_Developer/Sugar_Developer_Guide_8.2/Data_Framework/Database/DBManager/