Zend_Db_Table_Abstract and Zend_Db_Expr

Question

I have recently inherited an application, written using ZF, which has various fields encrypted in the db. There are many models extending Zend_Db_Table_Abstract with code similar to this example -

<?php
class Partner extends Zend_Db_Table_Abstract {

    protected $_name = 'partner', $_primary = 'id';

    public function createPartner( $mobile ){

        $id = $this->insert( array(
                        'mobile' => new Zend_Db_Expr("AES_ENCRYPT('$mobile', 'random_key')"),
                        'createdOn' => date('Y-m-d H:i:s', mktime())
                    ) );

        $res = $this->find($id);
        return $res->current();
    }

}
?>

My concern with this code is that $mobile is being passed literally into the query. What is the cleanest way to modify the way this value is being set, so that it uses quoteInto or some other method that uses place holders to parametrise the query?

user1191247 · Accepted Answer · 2012-02-28 22:26:49Z

5

How about

public function createPartner( $mobile ){

    $id = $this->insert( array(
                    'mobile' => new Zend_Db_Expr($this->getAdapter()->quoteInto("AES_ENCRYPT(?, 'random_key')", $mobile)),
                    'createdOn' => date('Y-m-d H:i:s', mktime())
                ) );

    $res = $this->find($id);
    return $res->current();
}

This seems to work but is there some problem with it that I am missing?

answered Feb 28, 2012 at 22:26

user1191247

13k2 gold badges25 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mouna Cheikhna · Accepted Answer · 2012-02-28 22:00:11Z

1

use prepared statement in this case :

$mobile = new Zend_Db_Expr("AES_ENCRYPT('$mobile', 'random_key')");
$date = date('Y-m-d H:i:s', mktime());

$stmt = $this->getAdapter()->prepare('INSERT INTO'.$this->_name.'(mobile, createdOn) VALUES (?, ?)');
$stmt->execute(array($mobile, $date));

answered Feb 28, 2012 at 22:00

Mouna Cheikhna

39.8k10 gold badges50 silver badges69 bronze badges

1 Comment

user1191247 Over a year ago

Thank you for this. I am aware of this way but was hoping there may be a way of doing it without having to rewrite every method that is currently using insert(). Any other suggestions?

Collectives™ on Stack Overflow

Zend_Db_Table_Abstract and Zend_Db_Expr

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related