Doctrine 原始 sql 和准备好的语句
我有一个使用准备好的语句的 Doctrine_RawSql 查询。 然而，当生成 SQL 查询时，它们似乎被忽略。 但是如果我遗漏了标记值，我会得到一个关于绑定变量数量不匹配的异常（因此它至少尝试将它们分入）。
如果我内联包含这些值，Doctrine 是否会在幕后做任何事情来防止 SQL 注入？
这是我的代码：
public function sortedPhotogsByLocation($location)
{
$q = new Doctrine_RawSql();
$result = $q->select('{p.*}')
->from('photographers p')
->addComponent('p', 'Photographer')
->where('p.city_id = ?', $location->id)
->orderBy('CASE WHEN p.lname < "?%" THEN 1 ELSE 0 END, p.lname ASC', $location->photographer_sort)
->execute();
return $result;
}
这提供了以下 SQL 输出：
SELECT *
FROM photographers p
WHERE p.city_id = ?
ORDER BY
CASE WHEN p.lname < "?%" THEN 1 ELSE 0 END, p.lname
ASC
编辑：$location 上的属性已正确设置。 如果我对参数进行硬编码：
->where('p.city_id = ?', 5)
我会遇到同样的问题，令牌未被替换。
I've got a Doctrine_RawSql query using prepared statements. However, they seem to get ignored when the SQL query is generated. But If I leave out the token values, I get an exception about number of bound variables not matching (so it's at least trying to sub them in).
If I include these values inline, is Doctrine doing anything behind the scenes to prevent SQL injection?
Here's my code:
public function sortedPhotogsByLocation($location)
{
$q = new Doctrine_RawSql();
$result = $q->select('{p.*}')
->from('photographers p')
->addComponent('p', 'Photographer')
->where('p.city_id = ?', $location->id)
->orderBy('CASE WHEN p.lname < "?%" THEN 1 ELSE 0 END, p.lname ASC', $location->photographer_sort)
->execute();
return $result;
}
This provides the following SQL output:
SELECT *
FROM photographers p
WHERE p.city_id = ?
ORDER BY
CASE WHEN p.lname < "?%" THEN 1 ELSE 0 END, p.lname
ASC
EDIT: The properties on $location are being set properly. If I hardcode the parameters:
->where('p.city_id = ?', 5)
I encounter the same problem with the tokens not being replaced.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我并不完全熟悉 Doctrine_RawSql，但占位符应该是单独的，而不是“？%”，只是？ 并在您传递的变量上添加％。 看一下示例#6。
I'm not entirely familiar with Doctrine_RawSql, but a placeholder should be by itself, not "?%", just ? and add the % on the variable you are passing. Take a look at example #6.