Zend secure sql queries?

Question

I was wondering if something like this, is safe in Zend:

$db = Zend_Registry::get('db');
$query = "SELECT * FROM tags t JOIN posts_tags pt ON pt.tag_id = t.tag_id where pt.post_id = " . $postid;
$select = $db->query();

I'm not checking the content of $postid is here.

Zend does this automatically when you make queries like this:

$db = Zend_Registry::get('db');
$select = $db->select();
$select->from(array('p' => 'posts'))
    ->join(array('u' => 'users'), 'u.user_id = p.post_userid')
    ->where('p.post_id = ?', $postid);

But I don't like this way of working, just writing queries is much faster for me. So should I be manually escaping or is this done for me? And what are the easiest ways to do this?

Tim Fountain · Accepted Answer · 2011-02-08 18:09:42Z

3

If you don't want to use Zend_Db_Select you can do:

$select = $db->query("SELECT * FROM tags t JOIN posts_tags pt ON pt.tag_id = t.tag_id where pt.post_id = ?", array($postid));

Where the 2nd param is an array of values to be dropped into the placeholders. See: http://framework.zend.com/manual/en/zend.db.statement.html

answered Feb 8, 2011 at 18:09

Tim Fountain

33.2k5 gold badges44 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Joe Green · Accepted Answer · 2011-02-08 17:31:50Z

1

Zend cannot be escaping your variable because it never sees it. Your variable is being appended to a string, and the $db->query method gets to see the string as a whole.

I don't think that the query() method does any sanitization anyway.

answered Feb 8, 2011 at 17:31

Joe Green

1,7871 gold badge13 silver badges17 bronze badges

Collectives™ on Stack Overflow

Zend secure sql queries?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related