Yii Query Builder: Parametr binding using where() method

Question

I have this code in my controller:

class ArchController extends Controller
{
public function actionIndex(string $date, array $rubric_id )
{
   $articles = Article::find()->where('published < :date', [':date' => $date])
                               ->andWhere(['in', 'rubric', $rubric_id])
                               ->andWhere('ISNULL(arch)')->all(); 
...

It seems to me it is not safe because $rubric_id is user input. How can I make parametr binding, something like this:

':rubric_id' => $rubric_id

how come the input $rubric_id is an array ? is it like some multi-select dropdown that you are submitting with mulitple id's as an array ? — Muhammad Omer Aslam
– Muhammad Omer Aslam, Commented Sep 8, 2019 at 13:34

rob006 · Accepted Answer · 2019-09-08 15:20:57Z

2

Yii uses parameter binding internally, so it is safe to use ->andWhere(['in', 'rubric', $rubric_id]). You can review implementation of InConditionBuilder to make sure of that.

answered Sep 8, 2019 at 15:20

rob006

22.3k5 gold badges57 silver badges77 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Yii Query Builder: Parametr binding using where() method

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related