I'm facing an issue with the dynamic parameters for the filter

$collection = $this->_collectionFactory->create()->addFieldToSelect('field_name');

If I have below code it works fine if the parameter is 2008, but if parameter is passed like 2008', I get an mysql error.

$collection->getSelect()->where($carYear.' >= substr(tyreld,7,4)');

with paramter 2008 The query is like: WHERE (2008 >= substr(tyreld,7,4)) with no error

with paramter 2008' The query is like: WHERE (2008' >= substr(tyreld,7,4)) This throughs an mysql syntax error

But if I tried the below code with no conditions it gives me no error.

->addFieldToFilter('tyreld', array('gteq' => $carYear));

How can we handle this type of issues.

  • actually not getting your line " if the parameter is 2008, but if parameter is passed like 2008'," can you please explain – Rutvee Sojitra May 28 '19 at 6:12
  • @RutveeSojitra I have updated my que – Mandar Parbate May 28 '19 at 6:20
  • so your column name is 2008' ? – Rutvee Sojitra May 28 '19 at 6:21
  • no, it's the value – Mandar Parbate May 28 '19 at 6:22
  • add your db screenshot or add db structure and let me know what you want to actually get – Rutvee Sojitra May 28 '19 at 6:24

You can try this:

The mysqli_real_escape_string() function escapes special characters in a string for use in an SQL statement.

you can also try below code:

$result = preg_replace('/[^a-zA-Z0-9_ -]/s','',$value);

| improve this answer | |
  • can you add the code in magento 2 way? – Mandar Parbate May 28 '19 at 8:44
  • updated my code, I dont thing that is there any default functionality provided by magento because magento using zend db adapter. you can use above php code. – Saphal Jha May 28 '19 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.