开发者

Escaping input for LIKE in Zend_Db

开发者 https://www.devze.com 2023-03-11 10:08 出处:网络
What is the right way to escape text that is passed to query with LIKE pattern matching? The problem is that

What is the right way to escape text that is passed to query with LIKE pattern matching? The problem is that

select()->where('field LIKE ?', $input . '%');

will be incorrect with

$input = '%sometext';

UPDATED: 'vulnerable to' -> '开发者_高级运维incorrect with'


It's not vulnerability, is it? It's valid content. If it poses vulnerability to your application (like WHERE user LIKE '%admin%') you should consider validating/filtering the input yourselves using sth like:

if (strpos('%', $input)){
     $input = strtr($input, '%', '');
}
0

精彩评论

暂无评论...
验证码 换一张
取 消