Do I need to take care of the security

Question

Do I need to take care of the security

abasov90 May '13

Created May '13	Last Reply Nov '15	Replies 2	Views 1265	Votes 2

abasov90 11.9k

May '13

in a position to filter the variables?

$robot = new Robots(); $robot->type = "mechanical"; $robot->name = "Astro Boy"; $robot->year = 1952;

//This record only must be created if ($robot->create() == false) { echo "Umh, We can't store robots right now: \n"; foreach ($robot->getMessages() as $message) { echo $message, "\n"; } } else { echo "Great, a new robot was created successfully!"; }

2

abasov90 · Answer 1 · 2013-05-11T10:45:02-07:00

abasov90
11.9k

May '13

mysql_real_escape_string ?

Phalcon · Answer 2 · 2013-05-11T11:15:51-07:00

No, you don't need to escape values manually, Phalcon uses bound parameters to prevent SQL injections:

https://docs.phalcon.io/en/latest/reference/models.html#avoiding-sql-injections

Daniel · Answer 3 · 2015-11-09T07:14:14-07:00

Hi,

How do I handle this situation without mysqli_escape_string:

        // Base model
    $client = new Client();

    // A raw SQL statement
    $sql = "select * from Client where ID not in (select ClientID from CompanyRouteNumber) and CompanyID = " . $param[0] . " and Address1 = '" .    mysqli_escape_string($client->getReadConnection(), $param[1]) . "'";

    // Execute the query
    $clients = new Resultset(null, $client, $client->getReadConnection()->query($sql));

I try, to bound parameters, but I failed.

Thank you.