sql - 如何在 CAKEphp 中阻止 sql 注入(inject)

Question

如何阻止来自像这样的页面的 sql 注入(inject)... http://u.neighborrow.com/items/recent

Answer 1

CakePHP already protects you against SQL Injection if you use CakePHP's ORM methods (such as find() and save()) and proper array notation (ie. array('field' => $value)) instead of raw SQL. For sanitization against XSS its generally better to save raw HTML in database without modification and sanitize at the time of output/display.

这应该让您对如何做到这一点有一个很好的了解。

App::import('Sanitize'); 
class MyController extends AppController {     ...     ... } 

完成此操作后，您可以静态调用 Sanitize。