自定义Eloquent查询绑定与Laravel 5的用法和限制

Question

Let's say the query looks like this:

$query = 'select * from some_table LIMIT :limit'

My db->selects are the following:

a) $orders = $db->select($db->raw($query), array("limit" => '0,10'));

b) $orders = $db->select($db->raw($query), array("limit" => '10'));

a) doesn't work, but b) does. Why?

Also this doesn't work:

$query2 = 'select :col from some_table LIMIT :limit';
$orders = $db->select($db->raw($query2), array("col" => "some_col","limit" => '10'));

Am I using it the wrong way?

Answer 1

You need to realize that prepared statements are not just formatted strings. The idea of prepared statements is that syntax and arguments are sent separately, so you can safely send user data without risking mysql injection. In query a) you are putting syntax in the parameter. The same can be said about the columns. Column names are part of the syntax.