note 82110 modified in function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Sat, 14 Mar 2009 15:02:15 +0000 |
| Subject: | note 82110 modified in function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151914@lists.php.net to get a copy of this message | ||
[This is] a database interface/wrapper class I use for every database action, and by default it
attempts to clean every variable while creating the queries.
<?php
//make a variable safe for querying (called by default on all query functions)
// $array = $db->sanitize($_GET) -- sanitize all GET variables
public function sanitize($var, $quotes = true) {
if (is_array($var)) { //run each array item through this function (by reference)
foreach ($var as &$val) {
$val = $this->sanitize($val);
}
}
else if (is_string($var)) { //clean strings
$var = mysql_real_escape_string($var);
if ($quotes) {
$var = "'". $var ."'";
}
}
else if (is_null($var)) { //convert null variables to SQL NULL
$var = "NULL";
}
else if (is_bool($var)) { //convert boolean variables to binary boolean
$var = ($var) ? 1 : 0;
}
return $var;
}
?>
Then, for example, in my insert function, I use it like this.
<?php
//insert values into an database
// $rows = column names
// $vals = ARRAY of values;
// pass a 3rd arg as
true to prevent sanitization
// $db->insert("name, email", array($name, $email))
public function insert($rows, $vals, $safe = false) {
$vals = ($safe) ? $vals : $this->sanitize($vals);
$this->sql = "INSERT INTO {$this->table} ( $rows ) VALUES (";
foreach ($vals as $key => $val) {
$this->sql .= ($key > 0) ? ", $val" : "$val";
}
$this->sql .= ")";
return $this->query();
}
?>
This way, every call is cleaned unless you explicitly tell it not to. Even if you just write a
shortcut function for generic mysql queries, I would do it similar to this. Always best to error on
the safe side. If anyone wants to see the rest of the class, send me an email.
--was--
I had an escape function very similar to Anonomyous 2-3 posts down, so I "borrowed" some
of his ideas and incorporated it into mine. Mine is included in a database interface/wrapper class
I use for every database action, and by default it attempts to clean every variable while creating
the queries.
<?php
//make a variable safe for querying (called by default on all query functions)
// $array = $db->sanitize($_GET) -- sanitize all GET variables
public function sanitize($var, $quotes = true) {
if (is_array($var)) { //run each array item through this function (by reference)
foreach ($var as &$val) {
$val = $this->sanitize($val);
}
}
else if (is_string($var)) { //clean strings
$var = mysql_real_escape_string($var);
if ($quotes) {
$var = "'". $var ."'";
}
}
else if (is_null($var)) { //convert null variables to SQL NULL
$var = "NULL";
}
else if (is_bool($var)) { //convert boolean variables to binary boolean
$var = ($var) ? 1 : 0;
}
return $var;
}
?>
Then, for example, in my insert function, I use it like this.
<?php
//insert values into an database
// $rows = column names
// $vals = ARRAY of values;
// pass a 3rd arg as true to prevent sanitization
// $db->insert("name, email", array($name, $email))
public function insert($rows, $vals, $safe = false) {
$vals = ($safe) ? $vals : $this->sanitize($vals);
$this->sql = "INSERT INTO {$this->table} ( $rows ) VALUES (";
foreach ($vals as $key => $val) {
$this->sql .= ($key > 0) ? ", $val" : "$val";
}
$this->sql .= ")";
return $this->query();
}
?>
This way, every call is cleaned unless you explicitly tell it not to. Even if you just write a
shortcut function for generic mysql queries, I would do it similar to this. Always best to error on
the safe side. If anyone wants to see the rest of the class, send me an email.
http://php.net/manual/en/function.mysql-real-escape-string.php