php - Laravel 准备语句 UPDATE 查询

Question

我想弄清楚如何更新数据库行，但我想防止 sql 注入(inject)

$postdata = $request->except('token');
$src = json_decode($postdata['data']);

$locationData = addslashes ( $src->locationData );
$userData = addslashes ( $src->userData );
if ( isset($src->routeData) ){
    $routeData = addslashes ( $src->routeData );
} else {
    $routeData = null;
}
$url = addslashes ( $src->url );

DB::statement("UPDATE maps SET locationData = '$locationData', userData = '$userData', routeData = '$routeData' WHERE url = ?", [$url]);

如果有人在上面向我展示如何保护查询，我将非常感激。

Answer 1

最安全的方法是使用模型:

模型/Map.php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class Map extends Model {
    protected $table = 'maps'
}

在你的代码中:

$url = 'blabla';
$locationData = 'dadada';
$userData = 'nomnomnom';

Map::where('url', '=', $url)->update(compact('locationData', 'userData'));