Can user execute update/delete XSS in query?

[d47081]

I'm using this escaping method:

      $query = $index->search(
        @\Manticoresearch\Utils::escape(
          $q
        )
      );

thoughts allow users make raw requests for extended (sphinx) queries

but they able to delete records from index? for example by doing something like:

...query');DELETE FROM...

as understand, access permissions like in MySQL not implemented in manticore?

Would be nice to allow extended features but worried somebody able to drop the index without escape method

[sanikolaev]

$index->search() doesn't use the /sql endpoint (https://manual.manticoresearch.com/Connecting_to_the_server/HTTP#/sql), so it's unlikely there can be an injection which would let you execute DELETE with a specific query. Even if search() used /sql, /sql can only run searches, you'd have to use /sql?mode=raw for everything else (https://manual.manticoresearch.com/Connecting_to_the_server/HTTP#/sql?mode=raw

You can read more about the sql() php method here https://github.com/manticoresoftware/manticoresearch-php/blob/abef209233f2acf03a9e1d3f2ba313cbf85ee0a9/docs/sql.md#sql

as understand, access permissions like in MySQL not implemented in manticore?

Correct.

[d47081]

Thanks, I will enable this method so as drafted before, but worried to use :)