How to prevent SQL injection in PhalconPHP when using sql in model?

Question

Let's say I am building a search that finds all the teacher and got an input where the user can put in the search term. I tried reading the phalcon documentation but I only see things like binding parameters. I read the other thread about needing prepare statements do I need that in Phalcon as well?

And my function in the model would be something like this:

public function findTeachers($q, $userId, $isUser, $page, $limit, $sort)
{
  $sql =  'SELECT id FROM tags WHERE name LIKE "%' . $q . '%"';
  $result = new Resultset(null, $this,
  $this->getReadConnection()->query($sql, array()));
  $tagResult = $result->toArray();
  $tagList = array();
  foreach ($tagResult as $key => $value) {
     $tagList[] = $value['id'];
  ....

  }
}

My question is for the Phalcon framework is there any settings or formats I should code for this line $sql = 'SELECT id FROM tags WHERE name LIKE "%' . $q . '%"';

And also any general recommendation for preventing SQL Injection in PhalconPHP controllers and index would be appreciated.

For reference:

My controller:

public function searchAction()
{
    $this->view->disable();
    $q = $this->request->get("q");
    $sort = $this->request->get("sort");
    $searchUserModel = new SearchUsers();
    $loginUser = $this->component->user->getSessionUser();
    if (!$loginUser) {
      $loginUser = new stdClass;
      $loginUser->id = '';
    }
    $page = $this->request->get("page");
    $limit = 2;
    if (!$page){
        $page = 1;
    }

    $list = $searchUserModel->findTeachers($q, $loginUser->id, ($loginUser->id)?true:false, $page, $limit, $sort);

    if ($list){
        $list['status'] = true;
    }
    echo json_encode($list);
}

My Ajax:

function(cb){
    $.ajax({
        url: '/search/search?q=' + mapObject.q + '&sort=<?php echo $sort;?>' +  '&page=' + mapObject.page,
        data:{},
        success: function(res) {
            //console.log(res);
            var result = JSON.parse(res);
            if (!result.status){
                return cb(null, result.list);
            }else{
                return cb(null, []);
            }
        },
        error: function(xhr, ajaxOptions, thrownError) {
            cb(null, []);
         }
});

with q being the user's search term.

Answer 1

You should bind the query parameter to avoid an SQL injection. From what I can remember Phalcon can be a bit funny with putting the '%' wildcard in the conditions value so I put them in the bind.

This would be better than just filtering the query.

$tags = Tags::find([
    'conditions' => 'name LIKE :name:',
    'bind' => [
        'name' => "%" . $q . "%"
    ]
])

Answer 2

Phalcon\Filter is helpful when interacting with the database.

In your controller you can say, remove everything except letters and numbers from $q.

$q = $this->request->get("q");
$q = $this->filter->sanitize($q, 'alphanum');