Zend Db avoiding sql injections

Question

I have the following code:

public function checkLoginDetails($email, $password) {
    $select = $this->select ();
    $select->where ( "password=?", md5($password) );
    $select->where ( "email=?", $email );
    return $this->fetchRow($select);

}

email and password come directly from the user. Do I need to filter email with, say, mysql_real_escape_string or does Zend DB do it for me?

Thank you!

Colunga

Answer 1

I was the main developer on Zend_Db, up to Zend Framework 1.0.

In the example you show, the values are interpolated into the query, with appropriate quotes and escaping applied. You don't have to do anything more.

Internally, it uses the quoting function built into the PHP extension for the Zend_Db_Adapter you're using. E.g. PDO::quote().

Deweydewhirst

I am using mysqli adapter instead of PDO. Does it make any difference? – Colunga

In that case it's using mysqli::real_escape_string(). Same effect. – Deweydewhirst