如何使用原始查询 mysql yii 绑定参数

Question

我正在使用原始文本查询来生成结果。但是为了避免 sql 注入，它希望对传入 userStat() 函数的变量即 $from 和 $to 进行参数化查询。

puclic function userStat($from, $to){
     $sql = "select u.user_id as ID, u.email as Email
            from User u
            where u.type = 'x'
            and u.join_date BETWEEN '$from'  AND '$to'";

    $rawData = Yii::app()->db->createCommand($sql);
    return $userData  = new CSqlDataProvider($rawData, array(
                'keyField'=>'ID',
            ));
}

现在我想将 $from 和 $to 与文本查询 ($sql) 绑定。

请帮我解决这个问题。

Answer 1

您可以使用bindParam，然后使用queryAll()。如下所示。

$sql = "select u.user_id as ID, u.email as Email
        from User u
        where u.type = 'x'
        and u.join_date BETWEEN :start  AND :end";
$rawData = Yii::app()->db->createCommand($sql);
$rawData->bindParam(":start", $from, PDO::PARAM_STR);
$rawData->bindParam(":end", $to, PDO::PARAM_STR);
$data = $rawData->queryAll();

详情bindParam。我想它会解决你的问题。

Answer 2

要绑定数据，请执行以下操作：

pubic function userStat($from, $to){
 $sql = "select u.user_id as ID, u.email as Email
        from User u
        where u.type = 'x'
        and u.join_date BETWEEN :from  AND :to";

$rawData = Yii::app()->db->createCommand($sql)->bindValues(array(':from'=>$from, ':to'=>$to));
return $userData  = new CSqlDataProvider($rawData, array(
            'keyField'=>'ID',
        )); }