Kohana v3，自动转义非法字符？
简单的问题，Kohana（版本 3）是否会自动转义传递到 ORM::factory...（以及与数据库有关的其他任何地方）的数据？
例如：
$thread = ORM::factory('thread', $this->request->param('id'));
第二个参数中传递的数据在进入 SQL 查询之前是否会自动转义，还是必须手动执行？可能是一个愚蠢的问题，安全总比后悔好，但是是的......我通常会手动转义数据，但我想知道 Kohana 是否为我这样做？
谢谢
Quick question, does Kohana (version 3) automatically escape data that is passed into ORM::factory..... (and everywhere else that has to do with the database)?
For example:
$thread = ORM::factory('thread', $this->request->param('id'));
Would the data passed in the second argument be auto-escaped before it goes in the SQL query or do I have to manually do it? Probably a stupid question and it's better to be safe than sorry, but yeah... I usually do manually escape the data, but I want to know if Kohana does this for me?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是自动逃逸的。唯一需要担心转义的情况是，如果您正在编写自己的 SQL 并直接插入数据（例如，通过串联），那么您不应该这样做。在 Kohana 中查询数据库的常规方法是参数化查询（如果您需要自己提供 SQL），查询构建器和 ORM，所有这些都会为您处理转义。
It's auto-escaped. The only scenario where you have to worry about escaping is if you're writing your own SQL and inserting your data directly (by way of concatenation, for example), which you shouldn't be doing. The normal ways of querying a database in Kohana are parametrized queries (if you need to provide the SQL yourself), the query builder, and ORM, all of which handle escaping for you.