Wednesday, 2 October 2013

Zebra Database...Insert Query Escape?

Zebra Database...Insert Query Escape?

I have two questions regarding mySQLi and hoping somebody can answer them!
1) Do you need to escape a query based on INSERT? E.g.
$query = "INSERT INTO users (username) VALUES (?)";
//Add to DB
if($stmt = $this->conn->prepare($query)) {
//Sanitize
$user = $this->conn->real_escape_string($username);
Where $this->conn->real_escape_string($username) is basically to a class
mySQLi's escape function.
2) In the event that you need to, how do you test that it successfully
escapes it, e.g. in Zebra Database?
http://stefangabos.ro/wp-content/docs/Zebra_Database/Zebra_Database/Zebra_Database.html#methodinsert
Because i don't seem to see the INSERT method on Zebra Database being
escaped when you insert using the query..
$db->insert('users', array('username' => $username, 'md5user' =>
$md5user, 'affiliate' => $affiliate, 'full_name' => $) );
It seems to only escape it if you have
array('username' => ?)
Any advise/thoughts?
Thanks!

No comments:

Post a Comment