Love Fuel?    Donate

FuelPHP Forums

Ask your question about FuelPHP in the appropriate forum, or help others by answering their questions.
MySQL functions in selects, escaping issues?
  • Hi! I've recently started to use your framework wich I've found really impressive so far, but I just had an issue with a complex query wich I tried to implement with the query builder class. My problem is that it seems like fuel doesn't really like nested mysql functions in the ->select() method. I get error messages about my query and when I see through the error message I see unrealistic escaping on the "table.colomn" references. Since I'm developing for a non english company pasting the whole code could be a bad idea but maybe you can manage to help me out with it afterall. If not, I'll try to translate it or its parts. So the code is this: $selectArray = array(
    'aktualiskepzesek.kezdesDatum',
    array('DATE_SUB(aktualiskepzesek.kezdesDatum, INTERVAL aktualiskepzesek.jelNapDiff DAY)','jelDate')
    ); $data = DB::select_array($selectArray )
    ->from('aktualiskepzesek')
    ->join('helyszinek', 'LEFT')->on('aktualiskepzesek.helyszinId', '=', 'helyszinek.id')
    ->join('telepulesek', 'LEFT')->on('helyszinek.telepulesId', '=', 'telepulesek.id')
    ->join('kepzesek', 'LEFT')->on('aktualiskepzesek.kepzesId', '=', 'kepzesek.id')
    ->join('kepzeskategoriak', 'LEFT')->on('kepzesek.kategId', '=', 'kepzeskategoriak.id')
    ->where('aktualiskepzesek.aktiv', '=', '1')
    ->where('DATE_ADD(kezdesDatum, INTERVAL kepzeskategoriak.startOffset DAY)', '>=', 'NOW()')
    ->where('aktualiskepzesek.kepzesId', '=', $page)
    ->and_where_open()
    ->where('ugyfelKatId', '=', '0')
    ->or_where('ugyfelKatId', '=', '2')
    ->and_where_close()
    ->order_by('aktualiskepzesek.kezdesDatum', 'ASC')
    ->execute()->as_array(); The error states that it has a problem at: ".jelNapDiff DAY)','jelDate')", but the compiled query part looks like this: DATE_SUB(aktualiskepzesek`.`kezdesDatum, INTERVAL aktualiskepzesek`.`jelNapDiff DAY) AS jelDate As you can see the "`" marks are missing at the begining, and in various parts. Is this a bug, or I've done something wrong? Thanks in advance!
  • Everything is automaticly escaped to prevent SQL-injection, how to work with that and still allow for SQL function is explained in the documentation.
  • Jelmer Schreuder wrote on Wednesday 25th of April 2012:
    Everything is automaticly escaped to prevent SQL-injection, how to work with that and still allow for SQL function is explained in the documentation.
    I'm terribly sorry for that. I checked the docs, but missed that paragraph. Thank you for your answer!

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

In this Discussion