JDatabaseQuery quote correctly the items into select

Question

I have written a database query, like so:

$query = $db->getQuery(true)
    ->select("u.*,ju.username,ju.email,ju.lastvisitDate as last_login")
    ->from("#__component_users AS u")
    ->leftJoin("#__users AS ju ON ju.id = u.uid");

How can I quote items in select clause, especially when there is an alias?

Answer 1

$db->quoteName(mixed $name, mixed $as = null)

https://api.joomla.org/cms-3/classes/JDatabaseQuery.html#method_quoteName

With the quoteName-function you can quote column names. It accepts strings and arrays. A simple quote with alias (the AS) would look like:

$db->quoteName('ju.lastvisitDate', 'last_login')

$as (the second parameter) is always optional. So if you don't want to give your column an alias just write

$db->quoteName('ju.lastvisitDate')

With an array it would like this:

$db->quoteName(array('ju.email', 'ju.lastvisitDate'), array(null, 'last_login'))

Note the null value in the second array if you don't want to give a column an alias.

As long as you don't use any reserved keywords or variables (e.g. submitted by the user) as column names I would not escape them. See also this: https://docs.joomla.org/Secure_coding_guidelines#Secure_field_names