FuelPHP Forums

viyancs

I have problem When I want to Passing field as parameter using QUERY BINDING, here my code

SELECT * FROM USERS ORDER BY :field :sort ;

When I am Check with echo DB::last_query(); the query show like this

SELECT * FROM USERS ORDER BY 'updated_at' 'ASC';

that query cannot sort because detection as string on mysql, How I can fix this ? any suggestion ?

Harro

Encapsulate the variables you pass in DB::expr(), which will prevent them being treated as strings.

viyancs

thanks that is work :)

Harro

1.6 now has DB::identifier() to solve this issue, DB::expr() disables all quoting, which is not a good solution.

DB::identifier('user.id') will return `user`.`id` (if you're using MySQL), so properly quoted.

viyancs

why DB::expr() is not good solution than DB::identifier('user.id') ?

actually I am still using old version :(

Harro

Because you should quote all identifiers for security reasons (and for possible column name vs keyword conflicts).

It's not a problem to use DB::expr(), but you will have to quote your identifiers manually (which makes your code not portable anymore).

FuelPHP Forums

Ask your question about FuelPHP in the appropriate forum, or help others by answering their questions.

Howdy, Stranger!

Categories

In this Discussion