Doctrinepersist（）是否可以防止SQL注入？

Question

I am wondering if the function persist() from Doctrine is safe to prevent SQL injection. I have searched, but after reading for a while, it still isn't clear to me. I am using Symfony 2:

$em = $this->getDoctrine()->getManager();
$em->persist($log);
$em->flush();

Answer 1

You can find answer to your question in Doctrine 2 documentation - here

You can consider the following APIs to be safe from SQL injection ... All values on Objects inserted and updated through Doctrine\\ORM\\EntityManager#persist()

So yes, persist should be safe from SQL injection.

Answer 2

是的，ORM会生成SQL并自动为您进行查询的实用化。