2

In Magento2 I have a Collection method for a search function like this:

 /**
     * @param string $q
     * @return $this
     */
    public function addSearchFilter($q)
    {
        $this->addFieldToFilter(
                array('title', 'content'),
                array(
                    array('like' => '%' . $q . '%'),
                    array('like' => '%' . $q . '%')
                )
            );
        return $this;
    }

My question is: is this safe? Or do I need to escape $q to prevent sql injection?

2

Yes, you can safely use this function without any escape on your side.

At the end of this function Magento call

public function prepareSqlCondition($fieldName, $condition)

and all passed variables quote by Zend.

As a result you get safely sql string

enter image description here

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.