YII束插入 - 避免SQL注入

Question

I insert big chunks of data to DB (~ 500) in the loop ( there are nearly 20000 or more records in total):

            $builder = Yii::app()->db->schema->commandBuilder;
            $command = $builder->createMultipleInsertCommand('product_supplier',
                  $dataToDb
            );
            $command->execute();

Using AR one can use validate() method to ensure that data are valid and AFAIK model escapes all dangerous data.

I would like to avoid to be SQL-injected.

Should I escape all data on my own when I use multiple insert or Yii takes care about it ?

Is it good idea to use standard PHP function "mysqli_escape_string " ?

I feel unsure how good it is.

Thanks.

Answer 1

The CDbCommand::createMultipleInsertCommand() method uses param binding, so it's safe.

ActiveRecords also use param binding and there's no extra escaping as it is not required.