webyjh 2012-01-11 19:45:27 4071次浏览 2条回复 0 0 0
public function actionSearchResult() {
    if (isset($_GET['SearchForm'])) {
        //接收表单传过来的关键字
        $keywords = $_GET['SearchForm']['keywords'];
        $dataProvider = new CActiveDataProvider('Downloads', array(
            'criteria' => array(
                'condition' => 'title like "%' . $keywords . '%"',
                'order' => 'id DESC',
            ),
        ));
    $this->render('searchResult', array('dataProvider' => $dataProvider));
    }
}

关键字$keywords会不会被SQL注入呢?

您需要登录后才可以回复。登录 | 立即注册