如何在Joomla 2.5中使查询SQL Injection安全

Question

How can I make this query sql injection safe please? Will JRequest::getVar ensure that the parameter that is passed is sql injection safe?

$product_id = JRequest::getVar('product_id')
$db = JFactory::getDBO();
$query = " select * from #__products where product_id=".$product_id."; ";       
$db->setQuery($query);
$data = $db->loadObjectList();
return $data[0];

Answer 1

Just as an extension of @Sudhir's answer.

JRequest has been depreciated since Joomla! 1.7 and is being progressively removed eg Potential backward compatibility issues in Joomla 3.0 . If you intend to keep your component around you may want to migrate your old style JRequest calls to JInput .

Answer 2

Yes, using getVar function to access request variables, will ensure that all user data is filtered before it's used somewhere else (such as in SQL queries). getVar method on the JRequest class automatically filters out the input (unless explicitly told otherwise).

You can also use quote to escape strings before inserting to database