SQL injection using length input about laravel-datatables

[yajra]

Thanks for reporting, I think this is already fixed in versions 10 & 11 as it ensures that int is returned for length.

    public function length(): int
    {
        $length = $this->request->input('length', 10);

        return is_numeric($length) ? intval($length) : 10;
    }

Please upgrade to at least 10.x version.

[yajra]

If you can't upgrade for some reason, feel free to submit a PR to the 9.0 branch. Thanks!

[jonjieviduya]

@yajra Is there any breaking changes when we upgrade to 10.x version? I'm currently using laravel8. And I also noticed that the website documentation is down.

[yajra]

The docs site is fixed. I think there is not much-breaking change from 9.x to 10.x and 11.x