note 63232 added to function.mysqli-real-escape-string
| From: | PHPManual at EZDispatch dot com | Date: | Thu, 16 Mar 2006 16:30:21 +0000 |
| Subject: | note 63232 added to function.mysqli-real-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-105937@lists.php.net to get a copy of this message | ||
This is a simple quote_smart function for MySQLi. It will quote & escape any number of strings,
adding commas between them so they can be used in an INSERT, etc. The first parameter must be a
mysqli db connection resource. After that, you can pass any number of strings, OR an array of
strings.
<?php
/**
* Escapes and quotes any number of strings (removes slashes first if magic
* quotes is on), and returns them as one string, comma seperated, and perfect
* for INSERTS etc.
*
* @param Resource $db Database link resource
* @param Strings Any number of arguments to be escaped and added to the returned string
* -OR-
* @param Array An array of strings of arguments to be escaped and added to the returned string
* @return string
*/
function quote_smart($db, $values){
if (!is_array($values)) {
$values = func_get_args();
$db = array_shift($values);
}
foreach($values as &$value){
if (get_magic_quotes_gpc()) {$value = stripslashes($value);}
$value = "'".$db->real_escape_string($value)."'";
}
return implode(',',$values);
}
?>
Use it like this:
<?php
//Make some fake data
$cust_info = array();
$cust_info['name'] = 'Cust Name';
$cust_info['address'] = '123 Some Place';
$cust_info['city'] = 'San Diego';
$cust_info['state'] = 'CA';
$cust_info['zip'] = '99999';
$cust_info['contact'] = 'John Doe';
$cust_info['phone'] = '999-999-9999';
//Create a query
$q = 'INSERT INTO
customer (name, address,
city, state, zip, contact, phone)
VALUES('.quote_smart($db, $cust_info['name'], $cust_info['address'],
$cust_info['city'], $cust_info['state'], $cust_info['zip'],
$cust_info['contact'], $cust_info['phone']).')';
// -OR-
$q = 'INSERT INTO customer (name, address,
city, state, zip, contact, phone)
VALUES('.quote_smart($db, $cust_info).')';
?>
Also, it can be used for a single string:
<?php
$_POST['post_body'] = quote_smart($db, $_POST['post_body']);
$q = "INSERT INTO posts (uid, date_time,
post) VALUES ('{$_SESSION['uid']}',
NOW(),'{$_POST['post_body']}')";
?>
----
Server IP: 66.163.161.117
Probable Submitter: 63.229.126.248
----
X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER
autolearn=no version=2.64
----
Manual Page -- http://www.php.net/manual/en/function.mysqli-real-escape-string.php
Edit -- http://master.php.net/note/edit/63232
Del: integrated -- http://master.php.net/note/delete/63232/integrated
Del: useless -- http://master.php.net/note/delete/63232/useless
Del: bad code -- http://master.php.net/note/delete/63232/bad+code
Del: spam -- http://master.php.net/note/delete/63232/spam
Del: non-english -- http://master.php.net/note/delete/63232/non-english
Del: in docs -- http://master.php.net/note/delete/63232/in+docs
Del: other reasons-- http://master.php.net/note/delete/63232
Reject -- http://master.php.net/note/reject/63232
Search -- http://master.php.net/manage/user-notes.php