在ZF引用一個值的SQL查詢2.1.4

Question

所以我已經升級到2.1.4 ZF，我用公告稱招呼：Attempting to quote a value in Zend\Db\Adapter\Platform\Mysql without extension/driver support can introduce security vulnerabilities in a production environment

我將對DBAdapter被實例化這樣：

return array(
    'service_manager' => array(
    'factories' => array(
     'Zend\Db\Adapter\Adapter' => 'Zend\Db\Adapter\AdapterServiceFactory', 
    ) 
    ), 
    'db' => array(
    'driver'   => 'pdo_mysql', 
    'driver_options' => array(
     PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'UTF8'" 
    ), 
    'dsn'   => 'mysql:dbname=test;host=192.168.1.8', 
    'username'  => 'test', 
    'password'  => 'test', 
    ) 
); 

我想引述如下：

$order = 'field(ce.id, ' . $this->_db->getPlatform()->quoteValueList($ids) . ')'; 
$select->order(new Expression($order)); 

我應該怎樣做呢？我的印象是pdo_mysql有驅動程序支持引用值。

Answer 1

看起來您已經通過添加$this->platform->setDriver($this->getDriver());找到了解決方案。也看看這個：

請參閱伴隨着本次發佈的公告和安全注意事項：http://framework.zend.com/security/advisory/ZF2013-03

發行說明：http://framework.zend.com/blog/2013-03-14-zend-framework-3-for-1-release-day.html

的