mysql-real-escape-string:CakePHP中的访问被拒绝

Question

在使用CakePHP将数据保存到我的数据库之前,我正在尝试使用mysql-real-escape-string对输入进行sanatize.我得到以下错误

mysql_real_escape_string()[function.mysql-real-escape-string]:拒绝访问用户'nobody'@'localhost'(使用密码:NO)

我的代码:

public function admin_videos($id = null) {
        if(!($this->isLogged() && $this->isAuthorized())) {
            $this->redirect(array('controller' => 'users', 'action' => 'login', 'admin' => true));
        }
        if ($this->request->is('post')) {
            $this->request->data['MovieVideo']['video'] = mysql_real_escape_string($this->request->data['MovieVideo']['video']);
            $this->request->data['MovieTrailer']['video'] = mysql_real_escape_string($this->request->data['MovieTrailer']['video']);
            if ($this->Movie->saveAll($this->request->data)) {
                $this->Session->setFlash('The movie has been saved', 'admin/flash_success');
                $this->redirect(array('action' => 'index'));
            } else {
                $this->Session->setFlash('The movie could not be saved. Please, try again.', 'admin/flash_error');
            }
        } else {
          $this->request->data = $this->Movie->find('first', array('conditions' => array('Movie.id' => $id), 'contain' => array('MovieTrailer', 'MovieVideo')));
        }
    }

Answer 1

来自文档:

如果您使用CakePHP的ORM方法(例如find()和save())和正确的数组表示法(即数组('field'=> $ value))而不是原始SQL,CakePHP已经保护您免受SQL注入.

所以忘了手动打电话mysql_real_escape_string().