Sanitize INSERT SELECT sql using Zend Framework

Question

How to do I sanitize this sql using Zend Framework, so that I can prevent sql injection attack?

"INSERT INTO table(A, B, C)
 SELECT MAX(A)+1, '".$params['B']."', '".$params['C']."' FROM table
 WHERE B='".$params['B']."' AND C='".$params['C']."'"

$params['B'] and $params['C'] are user inputs.

Raj · Accepted Answer · 2014-01-25 07:49:06Z

1

Use QuoteInto method to sanitize it.

To sanitize multiple arguments,

$stmt = $this->_db->prepare( 'SELECT * FROM ' . $this->_name . ' WHERE (a = ? AND b = ?) OR (c != ?)');
$stmt->execute(array($a, $b, $c));

answered Jan 25, 2014 at 7:49

Raj

23.1k14 gold badges105 silver badges148 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

What's the difference of using $this->_db->prepare($sql) instead of new Zend_Db_Statement_Pdo($this->_db, $sql)?