2015-07-03 10:03:46 3320次浏览 2条回答 0 悬赏 10 金钱

今天发现了一个,就你接受表单过来的数据,用这个$model->load就验证,他就直接插入了数据库,可是下面还调用了save();

  • 回答于 2015-07-03 10:20 举报

    load没有保存数据的,save才是真正的保存到数据库。
    请看源码:

    
        /**
         * Populates the model with the data from end user.
         * The data to be loaded is `$data[formName]`, where `formName` refers to the value of [[formName()]].
         * If [[formName()]] is empty, the whole `$data` array will be used to populate the model.
         * The data being populated is subject to the safety check by [[setAttributes()]].
         * @param array $data the data array. This is usually `$_POST` or `$_GET`, but can also be any valid array
         * supplied by end user.
         * @param string $formName the form name to be used for loading the data into the model.
         * If not set, [[formName()]] will be used.
         * @return boolean whether the model is successfully populated with some data.
         */
        public function load($data, $formName = null)
        {
            $scope = $formName === null ? $this->formName() : $formName;
            if ($scope === '' && !empty($data)) {
                $this->setAttributes($data);
    
                return true;
            } elseif (isset($data[$scope])) {
                $this->setAttributes($data[$scope]);
    
                return true;
            } else {
                return false;
            }
        }
    
    
        /**
         * Saves the current record.
         *
         * This method will call [[insert()]] when [[isNewRecord]] is true, or [[update()]]
         * when [[isNewRecord]] is false.
         *
         * For example, to save a customer record:
         *
         * ~~~
         * $customer = new Customer;  // or $customer = Customer::findOne($id);
         * $customer->name = $name;
         * $customer->email = $email;
         * $customer->save();
         * ~~~
         *
         *
         * @param boolean $runValidation whether to perform validation before saving the record.
         * If the validation fails, the record will not be saved to database.
         * @param array $attributeNames list of attribute names that need to be saved. Defaults to null,
         * meaning all attributes that are loaded from DB will be saved.
         * @return boolean whether the saving succeeds
         */
        public function save($runValidation = true, $attributeNames = null)
        {
            if ($this->getIsNewRecord()) {
                return $this->insert($runValidation, $attributeNames);
            } else {
                return $this->update($runValidation, $attributeNames) !== false;
            }
        }
    
  • 回答于 2015-07-05 21:56 举报

    最简单的验证就是你把save()给注释掉,再试一下就知道结果了。

您需要登录后才可以回答。登录 | 立即注册
风
副董事长

深圳

注册时间:2015-03-28
最后登录:2024-11-19
在线时长:273小时57分
  • 粉丝30
  • 金钱17738
  • 威望70
  • 积分21168

热门问题