Every single SQL request can be logged, but is also stored inside the Table object.
1 Model::first(1);
2 echo Model::table()->last_sql; // outputs SQL
find_by_sql is safe too.
1 Model::find_by_sql('SELECT * FROM `models` WHERE `name` = ?', array('John'));
But might not be if you're very dumb.
1 // Do *not* do this, *ever*!
2 Model::find_by_sql("SELECT * FROM `models` WHERE `name` = '$name'");
Except find_by_pk no methods are safe because you'll always be able to build some kind of SQL from variables. Be smart and don't mess with PDO.
Ah good very informative. Thank you Yoan. I've searched around the wiki and the forum and I haven't found sufficient documentation on using set_logger. Reading config.php and connection.php it looks as if I have to pass in my own class that has a method log with an argument $sql. How do I pass a class into set_logger?
p.s. you can pass a string into set_logger just fine until AR tries to call a method of the non-object. Interesting tidbit.
update: ok so I figured out how to pass a class into the initialize config. Is this the best way to do so?
1 class logger{ 2 public function log($sql){ 3 echo $sql."<br>"; 4 } 5 } 6 7 $theLogger = new logger(); 8 ActiveRecord\Config::initialize(function($cfg) use($theLogger) 9 { 10 $cfg->set_model_directory('model'); 11 $cfg->set_connections(array('development' => 'mysql://***:***@***/***')); 12 $cfg->set_logger($theLogger); 13 $cfg->set_logging(true); 14 15 }); 16
I would say no, because the first thing I want to do in my class logger is to throw my results into a DB which would require me to use AR which would require AR to be inside of AR. Inception!
Use the PEAR::Log to avoid inception:
- http://pear.php.net/package/Log
- http://www.indelible.org/php/Log/guide.html#the-sql-db-handler
Was I using the correct way of passing the logger into set_logger? If so maybe you can copy my example or an example using PEAR::log into the Wiki I bet others would benefit from this knowledge as well :)
The tests have an example:
https://github.com/kla/php-activerecord/blob/master/test/helpers/config.php#L49
The Wiki is by definition open, I'd say feel free to enrich it.
(1-6/6)
Subject: SQL Injection
I know that using find_by_sql will not protect against SQLI but if I was to search with something basic like:
model::first($id);
does that have SQLI protections?
Basically what does and what doesn't?