Home/ Questions/Q 8391615
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T19:18:39+00:00

A DQL query sample <?php $query = $em->createQuery(‘SELECT u FROM ForumUser u WHERE u.username

  • 0

A DQL query sample

<?php
$query = $em->createQuery('SELECT u FROM ForumUser u WHERE u.username = :name');
$query->setParameter('name', 'Bob');
$users = $query->getResult(); // array of ForumUser objects

The above example is a parametized query where name is set to Bob. As I’m trying to review code security in our project, I wanted to ask members of the doctrine community whether createQuery prepares the sql statement.

For instance, would injecting ‘ OR 1=1– to the ‘name’ parameter alter the query being created by the entitymanager?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    One of the greatest benefits of Doctrine and using a DBAL is injection protection. It will use prepared statements to not allow injection. Trying to add that string to the parameter will not result in a changed query.

    My friend wants me to correct myself by saying that the greatest benefit of Doctrine is not that it’s a DBAL, but it’s an ORM. This is true.

    • 0