使用占位符来解析Sql语句中的where子句

Question

i want to quote the values in a Where clause, Is this code a possible use of place holders?

 $where = "(user_id = ? AND company_id = ? AND color_id = ?)";  
 $values = array($userId, $companyId, $colorId);

 function qouteWhere($where, $values){
      foreach($values as $value)
           $where = $this->adapter->getPlatform()->quoteValue($value);

      return $where;  
 }

I appreciate any help. Thanks.

Answer 1

You do not need to quote values.

$where = new Zend\Db\Sql\Where();

$where->equalTo('user_id', $userId);
$where->equalTo('company_id ', $companyId);
$where->equalTo('color_id ', $colorId);

This way it is much more secure against SQL injection because of use prepared statements.