Verhindern SQL Injection in CodeIgniter

Question

verhindert CI Active Record SQL Injection?

hier ist mein Code

$this->db->select('t.DateTime, 
         su.FirstName, 
         su.MiddleName, 
         su.LastName, 
         l.Description, 
         t.Temperature, 
         t.UnitID, 
         t.Humidity'); 
    $this->db->from('temperaturelogs as t'); 
    $this->db->join('systemusers as su', 'su.UserID = t.Encoder'); 
    $this->db->join('locations as l', 't.LocationID = l.LocationID'); 
    $this->db->where("Cast(t.DateTime as date) >= '$start_date'"); 
    $this->db->where("Cast(t.DateTime as date) <= '$end_date'"); 
    $query = $this->db->get(); 

    if ($query->num_rows() > 0) 
    { 
     return $query->result_array(); 
    } 

wenn ich diesen Eingang in End Date auf Enter versucht.

Mein Input: '; Truncate Table systemusers; #

gibt mir diese Fehlermeldung:

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'truncate table systemusers; #'' at line 6

SELECT t . DateTime , su . FirstName , su . MiddleName , su . LastName , l . Description , t . Temperature , t . UnitID , t . Humidity FROM temperaturelogs as t JOIN systemusers as su ON su . UserID = t . Encoder JOIN locations as l ON t . LocationID = l . LocationID WHERE Cast(t.DateTime as date) >= '2016-03-21' AND Cast(t.DateTime as date) <= ''; truncate table systemusers; #'

der Fehler nicht relevant ...

Answer 1

Try werden,

$this->db->where('Cast(t.DateTime as date) >=', $start_date); 
$this->db->where('Cast(t.DateTime as date) <=', $end_date); 

Answer 2

verwenden, um meine Frage hat $this->db->escape($start_date); in Ihre Wo-Klausel.

Werfen Sie einen Blick auf SQL query escaping + codeigniter folgende

Ihre Active Query wäre dann so etwas wie dieses

$this->db->select('t.DateTime, 
         su.FirstName, 
         su.MiddleName, 
         su.LastName, 
         l.Description, 
         t.Temperature, 
         t.UnitID, 
         t.Humidity'); 
    $this->db->from('temperaturelogs as t'); 
    $this->db->join('systemusers as su', 'su.UserID = t.Encoder'); 
    $this->db->join('locations as l', 't.LocationID = l.LocationID'); 
    $this->db->where("Cast(t.DateTime as date) >= '".$this->db->escape($start_date)"'"); 
    $this->db->where("Cast(t.DateTime as date) <= '".$this->db->escape($end_date)"'"); 
    $query = $this->db->get(); 

Answer 3

CodeIgniter Sie benutzerdefinierte Schlüssel/Wert einzustellen liefert Methode in SQL Where-Klausel mit der folgenden angegebenen Methode.

Sie können einen Operator im ersten Parameter, um den Vergleich zu steuern sind:

$this->db->where('name !=', $name);
$this->db->where('id <', $id);
// Produces: WHERE name != 'Joe' AND id < 45