dove2199 2014-05-14 12:27
浏览 83
已采纳

使用占位符来解析Sql语句中的where子句

i want to quote the values in a Where clause, Is this code a possible use of place holders?

 $where = "(user_id = ? AND company_id = ? AND color_id = ?)";  
 $values = array($userId, $companyId, $colorId);

 function qouteWhere($where, $values){
      foreach($values as $value)
           $where = $this->adapter->getPlatform()->quoteValue($value);

      return $where;  
 }

I appreciate any help. Thanks.

  • 写回答

1条回答 默认 最新

  • doufei7464 2014-05-14 15:41
    关注

    You do not need to quote values.

    $where = new Zend\Db\Sql\Where();
    
    $where->equalTo('user_id', $userId);
    $where->equalTo('company_id ', $companyId);
    $where->equalTo('color_id ', $colorId);
    

    This way it is much more secure against SQL injection because of use prepared statements.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?