Question

这种方法;

Route::get('admin/user/delete/(:any)', array('as' => 'username', 'uses' => 'admin@user_delete_process'));

public function action_user_delete_process($username)
{
    $result = User::find($username)->delete();
}

我是否需要担心注射？

Answer 1

一般来说，ORM会处理所有的转义。除非您传递原始SQL查询，否则您应该没有转义输入。为了确认，我挖掘了Laravel的代码，并遇到了execute()方法，它确实使用了PDO::prepare：

/** laravel/database/connection.php, lines 219-278 */
protected function execute($sql, $bindings = array())
{
    /* ... */
    try
    {
        $statement = $this->pdo->prepare($sql);

        $start = microtime(true);

        $result = $statement->execute($bindings);
    }
    // If an exception occurs, we'll pass it into our custom exception
    // and set the message to include the SQL and query bindings so
    // debugging is much easier on the developer.
    catch (\Exception $exception)
    {
        $exception = new Exception($sql, $bindings, $exception);

        throw $exception;
    }
    /* ... */
}

Laravel3：如果我使用Eloquent，我需要消毒吗？

1 个答案: