Question

鉴于以下控制器方法,我是否有必要使<条码>(过滤<>/条码>)制度化。或者对我来说,这样做会失败吗? 如果是的话, c是否具备这方面的职能?

function ajax_load_games($filtro, $console_id){         
    $this->set( game , 
        $this->Game->find( all ,
            array( conditions  => array( Game.game_name LIKE  => "%$filtro%"))
        )
    );
}

Answer 1

I wouldnt call it sanitizing but escaping. it will be done automatically for all find operations if you use the basic wrappers (not query() directly).

Also note: It is done on basic save operations, as well: saveField, save, saveAll.

但是,对于询问或删除,你没有保护。所有人,更新者等!

Answer 2

如果你使用适当的阵列通知,则电离层法则适用于防止在<条码>、条码>、条码和<条码>中投射(即你可能意味着的)。

它这样说:

友情链接