Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How can I escape complex sql in Zend Framework?

I have the following sql (a simplification of the real problem):

SELECT *
FROM t
WHERE myname LIKE '%{$input}%';

How do I escape the $input?
I can't use the quoteInto (unless I miss something).
As

$sql=$DB->quoteInto("SELECT *
                     FROM t
                     WHERE myname LIKE '%?%'",$input);

Will give me

SELECT *
FROM t
WHERE myname LIKE '%'my input'%';

and

$sql=$DB->quoteInto("SELECT *
                     FROM t
                     WHERE myname LIKE ?",'%'.$input.'%');

Will give me something on the lines:

SELECT *
FROM t
WHERE myname LIKE '\%my input\%';
like image 296
Itay Moav -Malimovka Avatar asked Apr 12 '09 00:04

Itay Moav -Malimovka


1 Answers

The last option is works out well for me i've not experienced it escaping '%'. So $db->quote('%'.$_GET['query'].'%') outputs %queryvalue%

like image 95
Akeem Avatar answered Nov 01 '22 17:11

Akeem