Laravel3：如果我使用雄辩，我需要消毒吗？

Question

这种方法;

Route::get('admin/user/delete/(:any)', array('as' => 'username', 'uses' => 'admin@user_delete_process')); 

public function action_user_delete_process($username) 
{ 
    $result = User::find($username)->delete(); 
} 

我需要担心注射吗？

Answer 1

一般来说，ORM处理所有的转义。除非你传递原始的SQL查询，否则你应该没有逃避你的输入。为了证实，我通过Laravel代码挖，和整个​​方法，它的确利用PDO::prepare传来：

/** laravel/database/connection.php, lines 219-278 */ 
protected function execute($sql, $bindings = array()) 
{ 
    /* ... */ 
    try 
    { 
     $statement = $this->pdo->prepare($sql); 

     $start = microtime(true); 

     $result = $statement->execute($bindings); 
    } 
    // If an exception occurs, we'll pass it into our custom exception 
    // and set the message to include the SQL and query bindings so 
    // debugging is much easier on the developer. 
    catch (\Exception $exception) 
    { 
     $exception = new Exception($sql, $bindings, $exception); 

     throw $exception; 
    } 
    /* ... */ 
}