StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
985316
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
2
CommunityOwnedDate
CreationDate
2009-06-12T06:50:54.333
FavoriteCount
0
LastActivityDate
2013-11-11T15:03:22.917
LastEditDate
2013-11-11T15:03:22.917
LastEditorUserId
20860
OwnerUserId
20860
ParentId
975009
PostTypeId
2
Score
24
ViewCount
0
LastEditorDisplayName
text
Body
I wrote a lot of the code for database parameters and quoting in Zend Framework while I was the team lead for the project (up to version 1.0). I tried to encourage best practices where possible, but I had to strike a balance with ease of use. Note that you can always examine the string value of a <code>Zend_Db_Select</code> object, to see how it has decided to do quoting. <pre><code>print $select; // invokes __toString() method </code></pre> Also you can use the <code>Zend_Db_Profiler</code> to inspect the SQL that is run on your behalf by <code>Zend_Db</code>. <pre><code>$db->getProfiler()->setEnabled(true); $db->update( ... ); print $db->getProfiler()->getLastQueryProfile()->getQuery(); print_r $db->getProfiler()->getLastQueryProfile()->getQueryParams(); $db->getProfiler()->setEnabled(false); </code></pre> Here are some answers to your specific questions: <ul> <li><code>Zend_Db_Select::where('last_name=?', $lname)</code> Values are quoted appropriately. Although the "<code>?</code>" looks like a parameter placeholder, in this method the argument is actually quoted appropriately and interpolated. So it's not a true query parameter. In fact, the following two statements produce exactly the same query as the above usage: <pre><code>$select->where( $db->quoteInto('last_name=?', $lname) ); $select->where( 'last_name=' . $db->quote($lname) ); </code></pre> However, if you pass a parameter that is an object of type <code>Zend_Db_Expr</code>, then it's not quoted. You're responsible for SQL injection risks, because it's interpolated verbatim, to support expression values: <pre><code>$select->where('last_modified < ?', new Zend_Db_Expr('NOW()')) </code></pre> Any other part of that expression that needs to be quoted or delimited is your responsibility. E.g., if you interpolate any PHP variables into the expression, safety is your responsibility. If you have column names that are SQL keywords, you need to delimit them yourself with <code>quoteIdentifier()</code>. Example: <pre><code>$select->where($db->quoteIdentifier('order').'=?', $myVariable) </code></pre></li> <li><code>Zend_Db_Adapter_Abstract::insert( array('colname' => 'value') )</code> Table name and column names are delimited, unless you turn off <code>AUTO_QUOTE_IDENTIFIERS</code>. Values are parameterized as true query parameters (not interpolated). Unless the value is a <code>Zend_Db_Expr</code> object, in which case it's interpolated verbatim, so you can insert expressions or <code>NULL</code> or whatever.</li> <li><code>Zend_Db_Adapter_Abstract::update( array('colname' => 'value'), $where )</code> Table name and column names are delimited, unless you turn off <code>AUTO_QUOTE_IDENTIFIERS</code>. Values are parameterized, unless they are <code>Zend_Db_Expr</code> objects, as in <code>insert()</code> method. The <code>$where</code> argument is not filtered at all, so you're responsible for any SQL injection risks in that one. You can make use of the <code>quoteInto()</code> method to help make quoting more convenient.</li> </ul>
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POavoiding MySQL injections with the Zend_Db class
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. USBill Karwin
UserOwnerUserId
1. USBill Karwin
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. POavoiding MySQL injections with the Zend_Db class
 singulars
 PostTypePostTypeId
 PTQuestion
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
3. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. COGreat answer, Bill, and a great component all round :)
 singulars
 PostPostId
 PO
 UserUserId
 USDavid Snabel-Caunt

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.