note 80708 deleted from function.mysqli-query by nlopess
| From: | nlopess@php.net | Date: | Tue, 29 Jan 2008 20:14:12 +0000 |
| Subject: | note 80708 deleted from function.mysqli-query by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-135563@lists.php.net to get a copy of this message | ||
Note Submitter: mail at willboyce dot com
----
I have extended mysqli and taken query() a step further, as I was tired of forever escaping strings
before putting them in a database. queryf() emulates sprintf() style formatting, performing extra
sanitization on strings (%s).
<?php
...
public function squeryf() {
$argv = func_get_args();
if (is_array($argv[0]))
$argv = $argv[0];
$qry = array_shift($argv);
$matches = array();
$percents = preg_match_all("/(%[+-]{0,1}[-]{0,1}[\d]{0,}[bcdeufFosxX]{1})/", $qry,
$matches);
foreach($matches[1] as $match) {
$arg = array_shift($argv);
if ($match=="%s")
$arg = $this->real_escape_string(strip_tags($arg,
implode($this->allowed_tags)));
$qry = preg_replace("/$match/", sprintf($match, $arg), $qry, 1);
}
return $qry;
}
...
?>
The full class can be found at http://blog.willboyce.com/2008/01/29/mysqli2/
--
Regards, Will Boyce
http://willboyce.com