Sanitize input for SQL using Zend Framework?

Question

I'm aware of Quote and QuoteInto. Neither of which can help me with the following. I need to sanitize the input for the following SQL:

select * from log where message like '%bla%'

QuoteInto and Quote will add quotes that won't work with the % (wildcards). How do I sanitize this input so I end up with a "safe" SQL statement as above?

jcsanyi · Accepted Answer · 2013-06-26 06:04:53Z

3

Append the % characters directly to your variable, and quote the entire value.
That would look something like this:

 $value = 'bla';
 $db->quoteInto("SELECT * FROM log WHERE message LIKE ?", "%{$value}%");

As compared to this, which gives you the bad results you described:

 $value = 'bla';
 $db->quoteInto("SELECT * FROM log WHERE message LIKE '%?%'", $value);

edited Jun 26, 2013 at 6:04

answered Jun 26, 2013 at 5:56

jcsanyi

8,2042 gold badges31 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Sanitize input for SQL using Zend Framework?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related