PHPackages                             mschop/securemy - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Database & ORM](/categories/database)
4. /
5. mschop/securemy

ActiveLibrary[Database & ORM](/categories/database)

mschop/securemy
===============

Object oriented, immutable and 100% secure sql query builder for PHP

v0.1.0-alpha.1(8y ago)024MITPHPPHP >= 7.0

Since Mar 5Pushed 8y ago1 watchersCompare

[ Source](https://github.com/mschop/SecureMy)[ Packagist](https://packagist.org/packages/mschop/securemy)[ RSS](/packages/mschop-securemy/feed)WikiDiscussions master Synced 2mo ago

READMEChangelogDependencies (1)Versions (3)Used By (0)

SecureMy
========

[](#securemy)

SecureMy is a MySQL query builder, with focus on security. When using SecureMy, it should not be possible, to create an sql injection vulnerability.

basic usage
-----------

[](#basic-usage)

```
$qb = QueryBuilder::create();
$qb = $qb
    ->from('products', 'p')
    ->join(
        'product_categories',
        $qb->eq(
            $qb->column('pc.productId'),
            $qb->column('p.productId')
        ),
        'pc'
    )
    ->join(
        'categories',
        $qb->eq(
            $qb->column('pc.categoryId'),
            $qb->column('c.categoryId')
        ),
        'c'
    )
    ->groupBy('p.productId')
    ->select('p.productId', 'id')
    ->select($qb->func('count', '*'));

$build = $qb->build();
$stmt = $pdo->prepare($build->getQuery());
$stmt->execute($build->getParams());

```

examples of security vulnerabilities
------------------------------------

[](#examples-of-security-vulnerabilities)

### sql-injection through colmn names etc.

[](#sql-injection-through-colmn-names-etc)

Sometimes developer think it's a good idea, to make columns etc. dynamic, based on user input. This can be very risky, because databases and PDO do not support passing table or column names as parameters.

This would be the ideal solution (but unfortunately it's not supported)

```
$pdo = new PDO(...);
$query = "
    SELECT :column
    FROM producttable
    WHERE id = :id
";
$stmt = $pdo->prepare($query);
$stmt->execute([
    'column' => $_POST['column'],
    'id' => $_POST['id'],
]);

```

I often see very risky implementations that could, if not carefully applied, cause sql injection vulnerabilities. SecureMy protectect identifier through an character whitelist. Therefore it checks every identifier through the regex `/^[a-z0-9._ ]+$/i`. As you maybe noticed, this is not compatible to databases, which contain special character in table or column names. See "Cons".

### sql-injection through conditions

[](#sql-injection-through-conditions)

Most query builder allow doing something like this:

```
$qb = QueryBuilder::create();
$qb
    ->from('products')
    ->where("products.name = 'shirt'"); // most libs recomment doing ->where('roducts.name = :name') but none I found, ensures this

```

This is not secure, as this could result in very dangerous sql-injection vulnerabilities. Imagine an unexperienced developer doing this:

```
$qb = QueryBuilder::create();
$qb
    ->from('products')
    ->where("products.name = {$_GET['productName']}");

```

You cannot walk into this trap with SecureMy. SecureMy prevents you from doing such crap. This comes with a little trade of with regard to code verbosity:

```
$qb = QueryBuilder::create();
$qb
    ->from('products')
    ->where(
        $qb->eq($qb->column('products.name'), $_GET['productName'])
    );

```

pros and cons (compared to other query builder)
-----------------------------------------------

[](#pros-and-cons-compared-to-other-query-builder)

### pros

[](#pros)

- 100% secure
- immutable query builder
- works without existing connection

### cons

[](#cons)

- more verbose
- not compatible to table-, column-, view- or sp-names containing special characters

###  Health Score

21

—

LowBetter than 19% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity6

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity45

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

2992d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/8030310?v=4)[mschop](/maintainers/mschop)[@mschop](https://github.com/mschop)

---

Top Contributors

[![mschop](https://avatars.githubusercontent.com/u/8030310?v=4)](https://github.com/mschop "mschop (4 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/mschop-securemy/health.svg)

```
[![Health](https://phpackages.com/badges/mschop-securemy/health.svg)](https://phpackages.com/packages/mschop-securemy)
```

###  Alternatives

[doctrine/orm

Object-Relational-Mapper for PHP

10.2k285.3M6.2k](/packages/doctrine-orm)[jdorn/sql-formatter

a PHP SQL highlighting library

3.9k115.1M102](/packages/jdorn-sql-formatter)[illuminate/database

The Illuminate Database package.

2.8k52.4M9.4k](/packages/illuminate-database)[mongodb/mongodb

MongoDB driver library

1.6k64.0M546](/packages/mongodb-mongodb)[ramsey/uuid-doctrine

Use ramsey/uuid as a Doctrine field type.

90340.3M211](/packages/ramsey-uuid-doctrine)[reliese/laravel

Reliese Components for Laravel Framework code generation.

1.7k3.4M16](/packages/reliese-laravel)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)