title: Yii Join Table Command
body: <p><br />
  I'm currently working on Yii SQL Injection. I have the following command sql command to run:<br/> </p>
  
  <pre><code>SELECT p.email, p.email_secret, p.verificationcode, r.name
          FROM personal p
          JOIN profile r
          ON p.email='example@example.com'
  </code></pre>
  
  <p>I have written the following code with yii: </p>
  
  <pre><code>        $connection=Yii::app()-&gt;db;  
          $command=$connection-&gt;createCommand();
          $command-&gt;select('p.email, p.email_secret, p.verificationcode, r.name');
          $command-&gt;from('personal p');
          $command-&gt;join('profile r', 'p.email = r.email');
          $command-&gt;where('p.email=:email', array(':email'=&gt;'yeoh.chan1@gmail.com'));
          $rows=$command-&gt;queryAll();
  </code></pre>
  
  <p>I would like to know where this would be vulnerable SQL Injection and if so, what would be a better approach to deal with table joinings.</p>