note 81188 added to function.mysql-query
| From: | sk89q at osu1 dot php dot net | Date: | Sun, 17 Feb 2008 21:56:20 +0000 |
| Subject: | note 81188 added to function.mysql-query | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-136230@lists.php.net to get a copy of this message | ||
sprintf+mysql_query which auto-escapes.
Usage:
<?php
$db->queryf("SELECT
m.name FROM
test.members WHERE name=%s OR id=%d OR
sex IN (%a)", "Evil 'injection'", 'NaN',
array('male', 'female', 'both', 'other', "Alien
quote'man"));
?>
To be put into a class, and don't forget to change the $this->query() and $this->escape()
functions accordingly.
<?php
function queryf($sql)
{
$args = func_get_args();
@array_shift($args);
$this->queryf_args = $args;
$this->queryf_i = 0;
$query = preg_replace_callback("#%(.)#", array($this, 'queryf_format'),
$sql);
return $this->query($query);
}
function queryf_format($m)
{
$args = $this->queryf_args;
$i = &$this->queryf_i;
switch($m[1])
{
case '%':
return "%";
case 'a':
$s = array();
$arr = $args[$i++];
foreach($arr as $x)
{
$s[] = "'".$this->escape($x)."'";
}
return implode(",", $s);;=
case 's':
return "'".$this->escape($args[$i++])."'";
case 'd':
return "".intval($args[$i++])."";
default:
trigger_error("Bad type specifier: {$m[1]}", E_USER_ERROR);
}
}
?>
----
Server IP: 64.71.164.2
Probable Submitter: 138.23.21.189
----
Manual Page -- http://www.php.net/manual/en/function.mysql-query.php
Edit -- https://master.php.net/note/edit/81188
Del: integrated -- https://master.php.net/note/delete/81188/integrated
Del: useless -- https://master.php.net/note/delete/81188/useless
Del: bad code -- https://master.php.net/note/delete/81188/bad+code
Del: spam -- https://master.php.net/note/delete/81188/spam
Del: non-english -- https://master.php.net/note/delete/81188/non-english
Del: in docs -- https://master.php.net/note/delete/81188/in+docs
Del: other reasons-- https://master.php.net/note/delete/81188
Reject -- https://master.php.net/note/reject/81188
Search -- https://master.php.net/manage/user-notes.php