Not quote table-fields in Aura.Sql.Select

[guweigang]

Hi, i'm using Aura.Sql for a while...

last friday, i check mysql logs for secure purpose. i found a lot of un-quoted fields in sqls. like:

SELECT  id AS `uid`, name, age, sex FROM `rel_rev_file` WHERE age > 25 AND sex = 'female' OR id < 10 GROUP BY sex, age HAVING COUNT(age) > 60 ORDER BY id DESC, age LIMIT 20 OFFSET 40;

it just process field alias and table name, how about other fields???

[pmjones]

It'll quote only AS aliases, and fully-qualified (e.g., table.column) names.

[harikt]

@pmjones does that means the user should write as for the field ?

Eg: What do you think if the user has something like below

$select = new Aura\Sql\Select($sql);
$select->cols(array('id', 'author_id', 'title', 'body', 'count'));
$select->from('posts');