note 63611 added to security.database.sql-injection

Some of my usefull codes :) <?php /** * Static class SQLi to prevent before SQL Injection * * @author FanFataL */ class SQLi { /** * Private method to choose which filter use to external data * * @param char $type * @param string $value * @access private * @return mixed * @author FanFataL */ function _prepare($type, $value = '') { switch($type) { case 't': return ''.$value.''; // table name case 's': return '\''.(get_magic_quotes_gpc() ? $value : addslashes($value)).'\''; // string - for mysql e.g. use mysql_real_escape_string case 'd': return (int)$value; // integer case 'f': return (float)$value; // float value } return $value; } /** * Build sql statement * * @param string $query * @param [mixed $args [, mixed ...]] * @access public * @return string * @author FanFataL */ function prepare($query) { $args = func_get_args(); $i = 1; return preg_replace('/\%([tsdf])/e', 'SQLi::_prepare(\'\\1\', $args[$i++])', $query); } } // example $sql = SQLi::prepare('SELECT * FROM %t a INNER JOIN %t b ON b.id = a.id WHERE a.id=%d AND a.topic LIKE %s', 'topic_table', 'user_table', $_GET['id'], '%'.$_POST['search_word'].'%' ); // SELECT * FROM topic_table a INNER JOIN user_table b ON b.id = a.id WHERE a.id=2 AND a.topic LIKE '%test\'test\"test%' ?> Greetings ;) ... ---- Server IP: 195.136.184.34 Probable Submitter: 83.8.171.26 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- http://master.php.net/note/edit/63611 Del: integrated -- http://master.php.net/note/delete/63611/integrated Del: useless -- http://master.php.net/note/delete/63611/useless Del: bad code -- http://master.php.net/note/delete/63611/bad+code Del: spam -- http://master.php.net/note/delete/63611/spam Del: non-english -- http://master.php.net/note/delete/63611/non-english Del: in docs -- http://master.php.net/note/delete/63611/in+docs Del: other reasons-- http://master.php.net/note/delete/63611 Reject -- http://master.php.net/note/reject/63611 Search -- http://master.php.net/manage/user-notes.php