note 13475 added to function.str-replace.php
| From: | benjamin at kc dot rr dot com | Date: | Mon, 18 Jun 2001 16:34:32 +0000 |
| Subject: | note 13475 added to function.str-replace.php | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-14306@lists.php.net to get a copy of this message | ||
I was tring to find anything where I could parse many variables that a user entered to mySQL. It
basically takes out all the stupid little things that cause problems.
what is entered is:
te\st
t'est2
// USER ENTERED VARS
// ADD AS MANY AS YOU LIKE
$dbvars = array("te\st", "test2<>");
// FIND THESE IN VAR
// ADD MORE THINGS TO REPLACE BUT
// MAKE SURE YOU ADD TO dbreplace ARRAY TO
$dbfind = array("\\", "'", "<", ">");
// REPLACE WITH WHAT IT FOUND
$dbreplace = array("\\\\", "\'", "", "");
$num_vars = count ($dbvars);
$num_find = count ($dbfind);
$num_replace = count ($dbreplace);
for ($id=0; $id < $num_vars; ++$id) {
for ($idstr=0; $idstr < $num_find; ++$idstr) {
$dbvars[$id] = str_replace("$dbfind[$idstr]", "$dbreplace[$idstr]",
$dbvars[$id]);
}
echo ("$dbvars[$id]<br>");
}
what is returned is so you can put in to db:
te\\st
t\'est2
Let me know if there is a problem with this or a way to optimize it.
http://www.php.net/manual/en/function.str-replace.php