Re: mysql functions as find parameters
| From: | Justin Patrin | Date: | Tue, 12 Apr 2005 21:30:19 +0000 |
| Subject: | Re: mysql functions as find parameters | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-18711@lists.php.net to get a copy of this message | ||
On Apr 12, 2005 10:57 AM, Sasha Sklar <Sasha.Sklar@craveonline.com> wrote:
> Hi guys,
>
> I'm attempting to set a mysql function as an argument for a query using
> DataObject. Some code to clarify:
>
> $users->users_pw = "password('${_POST['users_pw']}')";
require_once('DB/DataObject/Cast.php');
$db =& $users->getDatabaseConnection();
$users->users_pw =
DB_DataObject_Cast::Sql('password('.$db->quoteSmart($_POST['users_pw']).')');
Since you're passing SQL directly in, you *must* quote the value.
>
> Obviously, when find() is run, the query has the password value escaped
> with single quotes.
>
> How do I prevent this? It seems to me that Cast has something to do with
> it, but I can't seem to get the syntax.
>
> Any ideas?
>
> Sasha Sklar
>
> Web Application Developer
>
> craveonline.com
>
>
--
Justin Patrin