Question

Good day!

I want to protect my database when I save a row in the Zend_Framework:

function addController() {
....   
  if ($form->isValid($_POST)) {
   addRecods($form->getValues());
  }
}

class DbManager extends Zend_Db_Table_Abstract
...
function addRecords(array $array) {
   $row = $this->createRow();
   $row->field1 = $this->field_from_form1;
   $row->field2 = $this->field_from_form2;
   ....
   $row->save(); 
}

How can I better escape input data from array in the addRecords function?

Thank you!

Answer 1

The Zend_Db_Table_Row::save() function, internaly uses the Zend_Db_Adapter_Abstract::insert() function to save data. Which in turn, quotes the data for you.

If you need to build your own sql queries, the the Zend_Db_Adapter classes provide several quoting functions for you to use. You can read more about them here: Quoting Values and Identifiers