本机 SQL 查询到 laravel 雄辩的查询

Question

我实际上对这段代码有两个问题。

$cash_advance = DB::select('
        SELECT p1.*, p3.fname, p3.mname, p3.lname 
        FROM cash_advance p1
        INNER JOIN(
            SELECT MAX(created_at) maxdate, customer_id
            FROM cash_advance
            GROUP BY customer_id
        ) p2
        ON p1.customer_id = p2.customer_id
        AND p1.created_at = p2.maxdate
        LEFT JOIN customer as p3 ON p1.customer_id = p3.id
        ORDER BY p1.created_at desc

第一个问题是，当使用这种查询而不是标准的 eloquent 查询时，是否存在任何可能的安全漏洞？

第二个是，我该如何转换？这是我一直在尝试做的示例代码。

$cash_advance = DB::select('p1.*', 'p3.fname', 'p3.mname', 'p3.lname')
        ->from('cash_advance as p1')
        ->join('cash_advance as p2', function($join){
            $join->select(DB::raw('max(created_at) as maxdate'), 'customer_id')
                ->on('p2.customer_id', '=', 'p1.customer_id')
                ->on('p2.maxdate', '=', 'p1.created_at')
                ->groupBy('p2.customer_id');
        })
        ->leftJoin('customer as p3', 'p1.customer_id', '=', 'p3.id')
        ->orderBy('p1.created_at', 'desc');
return \DataTables::of($cash_advance)
    ->addColumn('action', function($cash_advance){
        return '<button class="btn btn-xs btn-info view_cash_advance" id="'.$cash_advance->customer_id.'"><i class="material-icons" style="width: 25px;">visibility</i></button>';//info/visibility
    })
    ->make(true);

但数据表一直说http://datatables.net/tn/7

ajax 代码

var cash_advancetable = $('#cash_advancetable').DataTable({
            dom: 'Bfrtip',
            buttons: [
            ],
            processing: true,
            serverSide: true,
            ajax: "{{ route('refresh_cashadvance') }}",
            columns: [
                {render: function(data, type, full, meta){
                    return full.fname +" "+full.mname+" "+full.lname;
                }},
                {data: 'amount', name: 'amount'},
                {data: 'created_at', name: 'created_at'},
                {data: 'balance', name: 'balance'},
                {data: "action", orderable:false,searchable:false}
            ]
        });

第一个代码有效，我实际上是从 stackoverflow 中的另一个问题中得到这个想法的，但是它用于本机 php 而不是 larvel，所以我想将它转换为 eloquent 以便它更干净和 laravel 一样。

Answer 1

只要您不向 SQL 中添加 任何 原始用户输入（不使用绑定），这种查询就不会降低安全性。

使用这个查询：

$join = DB::table('cash_advance')
    ->select(DB::raw('max(created_at) as maxdate'), 'customer_id')
    ->groupBy('customer_id');
$sql = '(' . $join->toSql() . ') as p2';
$cash_advance = DB::table('cash_advance as p1')
    ->select('p1.*', 'p3.fname', 'p3.mname', 'p3.lname')
    ->join(DB::raw($sql), function($join){
        $join->on('p2.customer_id', '=', 'p1.customer_id')
            ->on('p2.maxdate', '=', 'p1.created_at');
    })
    ->leftJoin('customer as p3', 'p1.customer_id', '=', 'p3.id')
    ->orderBy('p1.created_at', 'desc')
    ->get();