开发者

Escaping input for LIKE in Zend_Db

What is the right way to escape text that is passed to query with LIKE pattern matching? The problem is that

select()->where('field LIKE ?', $input . '%');

will be incorrect with

$input = '%sometext';

UPDATED: 'vulnerable to' -> '开发者_高级运维incorrect with'


It's not vulnerability, is it? It's valid content. If it poses vulnerability to your application (like WHERE user LIKE '%admin%') you should consider validating/filtering the input yourselves using sth like:

if (strpos('%', $input)){
     $input = strtr($input, '%', '');
}
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜