ZF2爲DB查詢清理變量

Question

在Zend Framework 2中進行數據庫查詢時，我應該如何清理用戶提交的值？例如，$下面的SQL ID

$this->tableGateway->adapter->query(
    "UPDATE comments SET spam_votes = spam_votes + 1 WHERE comment_id = '$id'", 
    \Zend\Db\Adapter\Adapter::QUERY_MODE_EXECUTE 
); 

Answer 1

可以傳遞，當你執行參數..

$statement = $this->getAdapter()->query("Select * from test WHERE id = ?"); 
$result = $statement->execute(array(99)); 

$resultSet = new ResultSet; 
$resultSet->initialize($result); 

您也可以將其直接轉給查詢方法

$statement = $this->getAdapter()->query(
    "Select * from test WHERE id = ?", 
    array(99) 
); 
$result = $statement->execute(); 

$resultSet = new ResultSet; 
$resultSet->initialize($result); 

兩個將產生查詢「Select * from test WHERE id ='99'」

如果您想使用命名參數：

$statement = $this->getAdapter()->query("Select * from test WHERE id = :id"); 
$result = $statement->execute(array(
    ':id' => 99 
)); 

$resultSet = new ResultSet; 
$resultSet->initialize($result); 

如果你想你的報價表/字段名等：

$tablename = $adapter->platform->quoteIdentifier('tablename'); 

$statement = $this->getAdapter()->query("Select * from {$tablename} WHERE id = :id"); 
$result = $statement->execute(array(
    ':id' => 99 
));