Comments on: Zend Framework Zend_Db - When to Quote and When Not to Quote User Input

By: infoseeker

infoseeker — Fri, 23 Apr 2010 02:28:47 +0000

Here is an answer from the horse’s mouth:

http://stackoverflow.com/questions/975009/avoiding-mysql-injections-with-the-zend-db-class/985316#985316

By: Cristian

Cristian — Tue, 07 Dec 2010 12:58:00 +0000

Whe you make a select try to not do thinks like this:
$this->db->updatet(’table’,array(’row1′ => ‘data1′,’row2′=>’data2′),’id = ‘.$id);

use quoteInto. Ex:

$this->db->updatet(’table’,array(’row1′ => ‘data1′,’row2′=>’data2′),$this->db->quoteInto(’id = ‘, $id));

By: sonam

sonam — Sat, 05 Nov 2011 09:20:16 +0000

In Zend there are inbuilt $this->db->quoteInto() function, this function are used to remove
The following characters(i.e. magical characters):

\x00 �
\n
\r
\
‘
”
\x1a =

if you want to insert the form input in to database ,then you must use the “quote”, because it act as a sql anti injection, it prevent your site from hacking…..
One of the best example is your login form:

in login from there are query like:

select * from user_info where username=”sonam” and password=”sonam”;

so,

in the login page : if the user wrote:

username: “sonam=1 or 1=1
then the you can loged in with out password,

so use $this->db->quoteInto() function similar to as my brother Cristian Says