2

I am wondering if it is possible to escape string inside ON condition, something like binding params inside where condition. This is my code

$this->getSelect()->joinLeft(
                array('notcountries' => $countriesTable),
                "main_table.page_id = notcountries.page_id AND notcountries.country_id='$countryId'",
                array()
        )     
        ->where("notcountries.country_id IS null"); 

$countryId is received from user and can be potentially harmful string. What is a proper way to make $countryId safe string?

2 Answers 2

2

I found a way.

$this->getSelect()->joinLeft(
            array('notcountries' => $countriesTable),
            $this->getConnection()->quoteInto("main_table.page_id = notcountries.page_id AND notcountries.country_id=?",$countryId),
            array()
    )     
    ->where("notcountries.country_id IS null"); 
-1

You can add php checking just before passing this variable in ON condition.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.