Bad Experience With CodeIgniter


Hasin Hayder, shared with us his bad experience with CodeIgniter Open Source Framework. I understand the troubles that happened to their users database with such unexpected behavior, but it’s something to learn from. Personally I will never allow updating my tables without a clear and correct where condition. Below his email :

We use CodeIgniter internally to develop our web solutions. Day before yesterday we suffered a terrible situation for an internal bug in code igniter which corrupted data inside some tables of our application database and then it took hours to find the origin of that bug, to fix it and to repair the corrupted data. Let me explain what happened.

Lets guess that we have one table named “users” with the following field

At some point, if you want to update the password field of this table, for a particular user, what will you write in your code?

CodeIgniter’s ORM will create the query like the following

Well, it’s ok and the query seems pretty fine. Now what should happen if you pass a valid user id to this code? Password of only that user will be updated. But what will happen when the passed $user_id is null?? Thats the most pathetic part that Codeigniter ORM plays. Instead of generating the following query,

CodeIgniter’s ORM actually generates the following

You find the difference of the above two queries right? one contains “where user_id=” ” and another contains just “where user_id” . Now if your backend database is MySQL and this query executes? You know what the hell will happen? It will replace all the user’s password with this new password instead of failing as MySQL count the “where user_id” part equals to false and returns all users. But If your Database is PostgreSQL, it fails, you are lucky.

So day before yesterday we suffered this problem against our commercial application which corrupts our user profile data. We immediate fixed the issue from our backup db (well, we lost 3 data) and then we started to find out what actually went wrong and found this vulnerable bug in CI.

So we suggest the CodeIgniter team to fix the issue immediately and change their ORM code so that it creates the query like the following if the value of passed argument is null. because it will fail to execute in all db. Otherwise the fellow user’s of code igniter, prepare for the dooms day.

Previous articleGoogle Spreadsheet Added Chart Support
Next articlePEAR Election Started
Hatem Ben Yacoub, Energy engineer, Entrepreneur, ICT & eGov consultant, ITIL v3 Certified, Certified Document Imaging Architect (CDIA+), Senior Systems architect, PHP expert and PHP5.3 ZCE, OpenGov/OpenData Advocate, and Open source Evangelist.