note 78893 added to function.mysql-real-escape-string

Another variant on quote_smart. I figured the problem with other versions (and I *do* use them) is that they're trying to *not* quote numbers; so I turned it around to check for the input value being a string instead. Keep in mind that all incoming values via GET, POST, etc. are already strings. This version provides correct quoting for leading zeroes and single-digit numeric zeroes (a fault of most other versions), and places the burden of type-checking on the caller where it belongs (the caller implicitly controls the quoting via the type of value submitted to the function). All strings are quoted even if castable to a numeric type. Any non-string values are examined for being numeric and returned unchanged if so; otherwise an error is returned. I couldn't think of any real world scenarios where handling arrays, objects or booleans made sense (MySQL doesn't support any of these natively). This version also has two optional parameters that accept a boolean for "nullify" (returns NULL for nulls/empty strings/unset values if true instead of a quoted empty string) and "conn" (database connection resource for the mysql_real_escape_string function if desired). To skip the nullify parameter but use the conn parameter, send null for the second parameter in the call. Hope it'll help someone else out. <?php function quote_smart($value = "", $nullify = false, $conn = null) { //reset default if second parameter is skipped $nullify = ($nullify === null) ? (false) : ($nullify); //undo slashes for poorly configured servers $value = (get_magic_quotes_gpc()) ? (stripslashes($value)) : ($value); //check for null/unset/empty strings (takes advantage of short-circuit evals to avoid a warning) if ((!isset($value)) || (is_null($value)) || ($value === "")) { $value = ($nullify) ? ("NULL") : ("''"); } else { if (is_string($value)) { //value is a string and should be quoted; determine best method based on available extensions if (function_exists('mysql_real_escape_string')) { $value = "'" . (((isset($conn)) && (is_resource($conn))) ? (mysql_real_escape_string($value, $conn)) : (mysql_real_escape_string($value))) . "'"; } else { $value = "'" . mysql_escape_string($value) . "'"; } } else { //value is not a string; if not numeric, bail with error $value = (is_numeric($value)) ? ($value) : ("'ERROR: unhandled datatype in quote_smart'"); } } return $value; } ?> ---- Server IP: 208.69.120.35 Probable Submitter: 209.184.240.67 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/78893 Del: integrated -- https://master.php.net/note/delete/78893/integrated Del: useless -- https://master.php.net/note/delete/78893/useless Del: bad code -- https://master.php.net/note/delete/78893/bad+code Del: spam -- https://master.php.net/note/delete/78893/spam Del: non-english -- https://master.php.net/note/delete/78893/non-english Del: in docs -- https://master.php.net/note/delete/78893/in+docs Del: other reasons-- https://master.php.net/note/delete/78893 Reject -- https://master.php.net/note/reject/78893 Search -- https://master.php.net/manage/user-notes.php