Queries are not always simple, and sometimes I need to create a pure SQL query, the query builder also does not fit. При использовании DB::select, подготовливаются ли переменные, которые подставлены в запрос?
Will there be a sql injection in this case?
$mastersInCity = DB::select('SELECT
master_user.master_id,
masters.specialization,
category_letter_master.category_letter_id AS master_letter,
COUNT(*) AS count_in_city
FROM master_user
LEFT JOIN masters ON master_user.master_id = masters.id
LEFT JOIN category_letter_master ON category_letter_master.master_id = master_user.master_id
WHERE ' . $chooiseId . ' = ' . $cityId . ' GROUP
BY master_user.master_id, master_letter');
Or, in this case, it is better to use PDO directly, so as to manually prepare the request yourself, is it possible?
via Chebli Mohamed
Aucun commentaire:
Enregistrer un commentaire