Commit 833a4b94 by Larry Ullman

edit 'quoting table...'

parent 8a6acd13
...@@ -204,25 +204,23 @@ $connection->createCommand()->delete('user', 'status = 0')->execute(); ...@@ -204,25 +204,23 @@ $connection->createCommand()->delete('user', 'status = 0')->execute();
Quoting Table and Column Names Quoting Table and Column Names
------------------------------ ------------------------------
Most of the time you would use the following syntax for quoting table and column names: To make column and table names safe to use in queries, you can have Yii properly quote them for you:
```php ```php
$sql = "SELECT COUNT([[$column]]) FROM {{table}}"; $sql = "SELECT COUNT([[$column]]) FROM {{table}}";
$rowCount = $connection->createCommand($sql)->queryScalar(); $rowCount = $connection->createCommand($sql)->queryScalar();
``` ```
In the code above `[[X]]` will be converted to properly quoted column name while `{{Y}}` will be converted to properly In the code above, `[[$column]]` will be converted to properly quoted column name, while `{{table}}` will be converted to a properly-quoted table name.
quoted table name.
For table names there's a special variant `{{%Y}}` that allows you to automatically appending table prefix if it is set: There's a special variant on this syntax specific to tablenames: `{{%Y}}` automatically appends the application's table prefix to the provided value, if a table prefix has been set:
```php ```php
$sql = "SELECT COUNT([[$column]]) FROM {{%table}}"; $sql = "SELECT COUNT([[$column]]) FROM {{%table}}";
$rowCount = $connection->createCommand($sql)->queryScalar(); $rowCount = $connection->createCommand($sql)->queryScalar();
``` ```
The code above will result in selecting from `tbl_table` if you have table prefix configured like the following in your The code above will result in selecting from `tbl_table`, if you have table prefix configured like so:
config file:
```php ```php
return [ return [
...@@ -247,7 +245,7 @@ $sql = "SELECT COUNT($column) FROM $table"; ...@@ -247,7 +245,7 @@ $sql = "SELECT COUNT($column) FROM $table";
$rowCount = $connection->createCommand($sql)->queryScalar(); $rowCount = $connection->createCommand($sql)->queryScalar();
``` ```
Prepared statements Using Prepared Statements
------------------- -------------------
In order to securely pass query parameters you can use prepared statements: In order to securely pass query parameters you can use prepared statements:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment