CDbCommand未能執行SQL語句：SQLSTATE [42S22]：列未找到誼

Question

下面回顧關係：

return array(
     'product' => array(self::BELONGS_TO, 'Product', 'product_id'), 
     'profile' => array(self::BELONGS_TO, 'Profile', 'profile_id'), 
     'rating' => array(self::BELONGS_TO, 'Rating', 'rating_id'), 
     'reviewcomments' => array(self::HAS_MANY, 'Reviewcomment', 'review_id'), 
     'reviewhelpfuls' => array(self::HAS_MANY, 'Reviewhelpful', 'review_id'), 
        'commentCounts' => array(self::STAT, 'Reviewcomment', 'review_id'), 
    ); 

下面

控制器代碼：

$criteria = new CDbCriteria(); 
      $criteria->addCondition("t.seoUrl = :seoUrl"); 
      $criteria->addCondition("t.published = 1"); 
      $criteria->params = array("seoUrl"=>$seoUrl);    
      $data['product'] = Product::model()->find($criteria); 
      if($data['product']){ 
       $data['product']->hits = $data['product']->hits+1; 
       $data['product']->save(); 
      } else{ 
       throw new CHttpException(404, "Invalid Request for product"); 
      } 
      $product_id = $data['product']->id; 
      $criteria = new CDbCriteria(); 
      $criteria->addCondition("t.product_id = '$product_id'"); 

      if(isset($_GET['rating'])) 
      { 
       $rating_id = $_GET['rating']; 
       $criteria->addCondition("t.rating_id = '$rating_id'"); 
      }   


      $criteria->addCondition('t.status = "approved"'); 

      if(isset($_GET['sort'])) 
      { 
       $sorting = $_GET['sort']; 
       if($sorting=='newest') 
        $criteria->order = "t.postDate DESC"; 
       elseif($sorting=='oldest') 
        $criteria->order = "t.postDate ASC"; 
       elseif($sorting=='rating_high') 
        $criteria->order = "t.rating_id DESC"; 
       elseif($sorting=='rating_low') 
        $criteria->order = "t.rating_id ASC"; 
      } 

      $data['reviews'] = new CActiveDataProvider('Review', array(
       'criteria'=>$criteria, 
       'pagination'=>array('pagesize'=>4) 

      )); 

現在，當我運行這段代碼，我得到CDbCommand未能執行SQL語句：SQLSTATE [42S22]：未找到列：1054未知列'where子句中't.rating_id'

感謝您的幫助

Answer 1

使用 'T' 的別名，你的表的Intstead，開始使用getTableAlias(false, false) 你的情況，那就是：

$criteria->addCondition(Review::model()->getTableAlias(false, false).".rating_id = '$rating_id'"); 

更重要的是這個代碼尖叫SQL注入

$rating_id = $_GET['rating']; 
$criteria->addCondition("t.rating_id = '$rating_id'"); 

切勿使用用戶輸入而不處理它。 Yii允許你綁定爲你逃脫的值 - 沒有SQL注入的威脅（至少據我所知）。你應該像這樣創建你的標準：

$criteria->addCondition(Review::model()->getTableAlias(false, false).".rating_id = :rating_id"); 
$criteria->params = array(
    ':rating_id' => $rating_id, 
);