note 69365 added to function.mysql-query

Here's a parameterised query function for MySQL similar to pg_query_params, I've been using something similar for a while now and while there is a slight drop in speed, it's far better than making a mistake escaping the parameters of your query and allowing an SQL injection attack on your server. <?php # Parameterised query implementation for MySQL (similar PostgreSQL's PHP function pg_query_params) # Example: mysql_query_params( "SELECT * FROM my_table WHERE col1=$1 AND col2=$2", array( 42, "It's ok" ) ); if( !function_exists( 'mysql_query_params' ) ) { function mysql_query_params__callback( $at ) { global $mysql_query_params__parameters; return $mysql_query_params__parameters[ $at[1]-1 ]; } function mysql_query_params( $query, $parameters=array(), $database=false ) { // Escape parameters as required & build parameters for callback function global $mysql_query_params__parameters; foreach( $parameters as $k=>$v ) $parameters[$k] = ( is_int( $v ) ? $v : ( NULL===$v ? 'NULL' : "'".mysql_real_escape_string( $v )."'" ) ); $mysql_query_params__parameters = $parameters; // Call using mysql_query if( false===$database ) return mysql_query( preg_replace_callback( '/\$([0-9]+)/', 'mysql_query_params__callback', $query ) ); else return mysql_query( preg_replace_callback( '/\$([0-9]+)/', 'mysql_query_params__callback', $query ), $database ); } } ?> ---- Server IP: 85.116.0.130 Probable Submitter: 88.144.15.254 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-query.php Edit -- https://master.php.net/note/edit/69365 Del: integrated -- https://master.php.net/note/delete/69365/integrated Del: useless -- https://master.php.net/note/delete/69365/useless Del: bad code -- https://master.php.net/note/delete/69365/bad+code Del: spam -- https://master.php.net/note/delete/69365/spam Del: non-english -- https://master.php.net/note/delete/69365/non-english Del: in docs -- https://master.php.net/note/delete/69365/in+docs Del: other reasons-- https://master.php.net/note/delete/69365 Reject -- https://master.php.net/note/reject/69365 Search -- https://master.php.net/manage/user-notes.php