mardi 11 décembre 2018

Is it safe to use DB :: select and others in Laravel?

Queries are not always simple, and sometimes I need to create a pure SQL query, the query builder also does not fit. При использовании DB::select, подготовливаются ли переменные, которые подставлены в запрос?

Will there be a sql injection in this case?

$mastersInCity = DB::select('SELECT
        master_user.master_id,
        masters.specialization,
        category_letter_master.category_letter_id AS master_letter,
        COUNT(*) AS count_in_city

        FROM master_user

        LEFT JOIN masters ON master_user.master_id = masters.id
        LEFT JOIN category_letter_master ON category_letter_master.master_id = master_user.master_id 

        WHERE ' . $chooiseId . ' = ' . $cityId . ' GROUP 

        BY master_user.master_id, master_letter');

Or, in this case, it is better to use PDO directly, so as to manually prepare the request yourself, is it possible?



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire