变量需要包装成一个字符串[复制]

Question

This question already has an answer here:

• How can I prevent SQL injection in PHP? 28 answers

I have written this query,

    $sql = "SELECT `candidates`.`candidate_id`, `candidates`.`first_name`, `candidates`.`surname`, `candidates`.`DOB`, `candidates`.`gender`, DATE_FORMAT(NOW(), '%Y') - DATE_FORMAT(`candidates`.`DOB`, '%Y') - (DATE_FORMAT(NOW(), '00-%m-%d') < DATE_FORMAT(`candidates`.`DOB`, '00-%m-%d')) AS `age`, `candidates`.`talent`, `candidates`.`location`, `candidates`.`availability`, `candidate_assets`.`url`, `candidate_assets`.`asset_size`
            FROM `candidates`
            LEFT JOIN `candidate_assets` ON `candidate_assets`.`candidates_candidate_id` = `candidates`.`candidate_id`
            WHERE `candidates`.`availability` = 'yes'";

            if(isset($type)) {
                $sql .= ' AND candidates.talent = '. "$type";
            }

            if(isset($skill))
            {
                $sql .= ' AND candidates.skill = '."$skill";
            }

            if(isset($gender))
            {
                $sql .= ' AND candidates.gender = '."$gender";
            }

    $query = $this->db->query($sql);

    return $query->result_array();

I wanting to the $type, $skill and $gender variable to passed as strings that whatever the variables contain are returned in the sql as wrapped in "" is this possible? How would I do this?

</div>

Answer 1

I'm basing on how the method looks and some of your previous question, and according to this you can use $this->db->escape_str($value) on those variables, so they're escaped as string no matter what type they are.