如何防止从此查询的SQL注入? [英] how to prevent sql injection from this query?
本文介绍了如何防止从此查询的SQL注入?的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!
问题描述
我正在使用Yii 1,我想构建以下查询:
I am using Yii 1, I want to build the following query:
$a = Model::model()->findAllBySql(
'SELECT * FROM table WHERE name like "%'.$_GET['name'].'%"'
);
为防止sql注入,我将其编写如下:
To prevent the sql injection I wrote it as follow:
$a = Model::model()->findAllBySql(
'SELECT * FROM table WHERE name like "%:name%"',
array("name"=>$_GET['name'])
);
,但未返回任何数据.此查询中有任何错误吗?
but it returned no data. Are there any errors in this query ?
推荐答案
引用占位符不是占位符时,它是字面值.尝试这种方式:
When the placeholder is quoted it is not a placeholder, it is the literal value. Try it this way:
$a = Model::model()->findAllBySql(
'SELECT * FROM table WHERE name like :name',
array(":name"=> '%' . $_GET['name'] . '%')
);
驱动程序当前会自动添加冒号,但将来可能会不自动添加冒号,最好使名称与占位符匹配.
The driver currently auto-appends the colons but it might not in the future, it is best to have the name match the placeholder.
这篇关于如何防止从此查询的SQL注入?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!
查看全文