Zendframework - mysql injection how to protect

Question

If I use methods e.g. insert, update in ZF Will I be safe(mysql injection)?

for example a part of code:

            $data = array(
                'autor' => $autor,
                'title' => $title,
                'text' => $text,
                'date' => $date,
            );
            $news = new News();
            $news->insert($data); // safe?

May be this answer can help.

Starx
– Starx

2011-10-14 07:17:08 +00:00
Commented Oct 14, 2011 at 7:17 — Starx
– Starx, Commented Oct 14, 2011 at 7:17

Community · Accepted Answer · 2023-11-21 15:10:29Z

1

Comments

Teodor Talov · Accepted Answer · 2011-04-18 15:14:08Z

1

I think it will be fine just the way you have it. I mean one of the advantages of using PDO ext is to prevent SQL injections using PHP instead of MySQL to query the database. Here is more from devzone.zend.com

answered Apr 18, 2011 at 15:14

Teodor Talov

1,9632 gold badges25 silver badges39 bronze badges

Comments

Fidi · Accepted Answer · 2011-04-18 15:19:28Z

1

It's fine the way you are doing it. But be careful with mysql-expressions. There you should use a Zend_Db_Expr-Object:

$data = array(
    'author' => 'John Doe',
    'title' => 'Headline goes here',
    'text' => 'The content...',
    'date' => new Zend_Db_Expr('NOW()') //  <--- use this for SQL-Expressions
);
$news = new News();
$news->insert($data);

answered Apr 18, 2011 at 15:19

Fidi

5,8241 gold badge20 silver badges25 bronze badges

2 Comments

Tomáš Fejfar Over a year ago

Actually any expression containing () will be converted automaticaly ;)

Fidi Over a year ago

framework.zend.com/manual/en/zend.db.table.html Look at Example #13 and the text above: By default, the values in your data array are inserted as literal values, using parameters. If you need them to be treated as SQL expressions, you must make sure they are distinct from plain strings. Use an object of type Zend_Db_Expr to do this.

Collectives™ on Stack Overflow

Zendframework - mysql injection how to protect

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related