这样写条件会不会被SQL注入? - 话题

webyjh 2012-01-11 19:45:27 4413次浏览 2条回复 0 0 0

public function actionSearchResult() {
    if (isset($_GET['SearchForm'])) {
        //接收表单传过来的关键字
        $keywords = $_GET['SearchForm']['keywords'];
        $dataProvider = new CActiveDataProvider('Downloads', array(
            'criteria' => array(
                'condition' => 'title like "%' . $keywords . '%"',
                'order' => 'id DESC',
            ),
        ));
    $this->render('searchResult', array('dataProvider' => $dataProvider));
    }
}