Php on zend, how to escape a variable for a query?

Question

im doing some queries in Zend Framework and i need to make sure no SQL injection is possible in the next kind of formats. I can use mysql_escape(deprecated) and wont do all the work. If i try to use real_mysql_escape it wont be able to grab the conection with the database and i cant find how zend_filter would solve the problem.

The query im doing (simplied) have the next sintaxes:

    $db = Zend_Registry::get('db'); 
    $select = "SELECT COUNT(*) AS num
                FROM message m
                WHERE m.message LIKE '".$username." %'";
    $row = $db->fetchRow($select);

What is the best way to prevent SQL INJECTION with this framework?

karim79 · Accepted Answer · 2009-03-28 18:41:08Z

19

Easy:

$db->quote($username);

So:

   $username = $db->quote($username . '%');
   $select = 'SELECT COUNT(*) AS num
                                FROM message m
                                WHERE m.message LIKE ' . $username;
   $row = $db->fetchRow($select);

answered Mar 28, 2009 at 18:41

karim79

343k67 gold badges420 silver badges409 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gisheri Over a year ago

when I use $db->quote on a string that I am inserting, it puts quotes into the string even in the database field. Do I have to trim it after i quote it, or am I using it incorrectly?

Konstantin Tarkus · Accepted Answer · 2009-03-28 18:40:48Z

14

$sql = 'SELECT * FROM messages WHERE username LIKE ?';
$row = $db->fetchRow($sql, $username);

Reference: http://framework.zend.com/manual/en/zend.db.html

answered Mar 28, 2009 at 18:40

Konstantin Tarkus

38.6k14 gold badges137 silver badges123 bronze badges

1 Comment

Bibendus Over a year ago

The % is missing in this example, could it work suffixing $username with '%'?

Ben Bos · Accepted Answer · 2013-12-09 17:00:07Z

1

When working with a model you can use:

$bugs = new Bugs();
$row = $bugs->fetchRow($bugs->select()->where('bug_id = ?', 1));

edited Dec 9, 2013 at 17:00

answered Jun 12, 2013 at 10:36

Ben Bos

2,3711 gold badge19 silver badges14 bronze badges

Collectives™ on Stack Overflow

Php on zend, how to escape a variable for a query?

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related