且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何防止此查询的 sql 注入?

更新时间:2023-09-11 23:46:28

当占位符被引用时,它不是占位符,而是字面值.试试这个方法:

When the placeholder is quoted it is not a placeholder, it is the literal value. Try it this way:

$a = Model::model()->findAllBySql(
                      'SELECT * FROM table WHERE name like :name',
                      array(":name"=> '%' . $_GET['name'] . '%')
                      );

驱动程序当前自动附加冒号,但将来可能不会,***让名称与占位符匹配.

The driver currently auto-appends the colons but it might not in the future, it is best to have the name match the placeholder.