Zend db - When should I quote to avoid sql injection?

I am confused about when the framework automatically quotes and when it does not quote variables. For example, as far as I can tell, it does not quote on the where clause (unless you use an extra parameter?).

Is there a guide/cheat-sheet that references when we must manuall开发者_运维知识库y quote in basic CRUD operations?

Thank you.

For me, the basic "rule of thumb" is the following:

• If you need to insert the value into a string, like that: "SELECT * from TABLE WHERE value=$value" you must quote it first.
• If you are using a placeholder, e.g. $select->where('value = ?', $value');, or an array of values such as array('value' => $value), the framework will quote the value for you.

Hope it helps,

Never build the query string yourself, always let Zend_Db do it for you. I.e., don't specify your where clauses (and the like) by building the string yourself:

$where = 'id = ' . $_REQUEST['id'] . ' and thing = ' . $_REQUEST['thing'];
$select->where($where);

Instead do this:

$select
    ->where('id = ?', $_REQUEST['id'])
    ->where('thing = ?', $_REQUEST['thing']);