为什么我的Doctrine DBAL查询在引用时没有返回结果？

Question

I'm using the Doctrine DataBase Abstraction Layer (DBAL) to perform some queries. For some reason, when I quote a parameter before passing it to the query, I get back no rows. When I pass it unquoted, it works fine.

Here's the relevant snippet of code I'm using:

  public function get($game)
  {
    load::helper('doctrinehelper');
    $conn = doctrinehelper::getconnection();
    $statement = $conn->prepare('SELECT games.id as id, games.name as name, games.link_url, games.link_text, services.name as service_name, image_url 
                                 FROM games, services 
                                 WHERE games.name = ? 
                                 AND services.key = games.service_key');
    $quotedGame = $conn->quote($game);

    load::helper('loghelper');
    $logger = loghelper::getLogger();
    $logger->debug("Quoted Game: $quotedGame");
    $logger->debug("Unquoted Game: $game");

    $statement->execute(array($quotedGame));
    $resultsArray = $statement->fetchAll();
    $logger->debug("Number of rows returned: " . count($resultsArray));  
    return $resultsArray;
  }

Here's what the log shows:

01/01/11 17:00:13,269 [2112] DEBUG root - Quoted Game: 'Diablo II Lord of Destruction'
01/01/11 17:00:13,269 [2112] DEBUG root - Unquoted Game: Diablo II Lord of Destruction
01/01/11 17:00:13,270 [2112] DEBUG root - Number of rows returned: 0

If I change this line:

$statement->execute(array($quotedGame));

to this:

$statement->execute(array($game));

I get this in the log:

01/01/11 16:51:42,934 [2112] DEBUG root - Quoted Game: 'Diablo II Lord of Destruction'
01/01/11 16:51:42,935 [2112] DEBUG root - Unquoted Game: Diablo II Lord of Destruction
01/01/11 16:51:42,936 [2112] DEBUG root - Number of rows returned: 1

Have I fat-fingered something?

Answer 1

Actually, this is an architectural thing (IMO). Doctrine is based on PHP's PDO. PDO works with Prepared Statements so there is no need to quote, use mysql_real_escapestring or anything. The ORM has has as a base design goal in it's very core and with PDO, it does this fairly secure.