Zend - Do I need to use quote () when inserting / updating?

Question

I am developing an application that allows users to enter VARCHAR (255) fields in mySQL, so security is a serious concern.

I'm having trouble understanding quote (). If I use quote ('test'), the data is returned as '\' test \ '' on SELECT, which is undesirable. How to disable this data?

If I get around quote (), I can look into phpmyadmin and see "test", so Zend doesn't seem to speed up quotes automatically ...

My code looks something like this:

    public function getDbTable () {
        if (null === $ this -> _ dbTable) {
           $ this-> setDbTable (new Zend_Db_Table ($ this -> _ tableName));
        }
        return $ this -> _ dbTable;
    }

    private function insert ($ anObject) {
        $ row ['cell1'] = $ anObject-> getCell1 ();
        $ row ['cell2'] = $ anObject-> getCell2 ();

         $ this-> getDbTable () -> insert ($ row);
    }

Should I use quote () around $ anObject-> getCell1 () etc. when inserting and updating?

Answer 1

No, Zend does it for you.

If I get around the quote (), I can look into phpmyadmin and see the “test”, so it doesn't seem like Zend will quote me automatically ...

If you see the “test” (with quotes) in the PMA, it means that Zend is successfully quoting your string. If Zend did not specify () this - you would see an exception due to an incorrect request .; -)

Answer 2

Zend_Db_Table_Abstract:: insert Zend_Db_Adapter_Abstract:: insert . Zend_Db , SQL- insert. , .