note 68285 deleted from function.mysql-real-escape-string by danbrown

Note Submitter: djogopatrao at gmail dot com ---- According to the newsforge refered to by Picky, it is adviseable to run PREPAREd statements in order to avoid injection. Plus, I created a table that stores pre-defined prepared statements and a procedure that runs that query. That way it's possible to control more tighly what's to be queried. Example in mysql5 lingo: create sys_queries ( name varchar(100), # query ID mysql_statement text, # primary key( name ) ); insert into sys_queries set name='search_users', 'SELECT * FROM users WHERE concat( username, name, email ) REGEXP ?'; delim $$ create sp_perform_query( _name varchar(100), _search_term varchar(255) ) begin DECLARE _stat TEXT DEFAULT NULL; SELECT mysql_statement INTO _stat FROM sys_queries WHERE name = _name; IF _stat IS NOT NULL THEN SET @a = _stat; SET @b = _search_term; PREPARE s FROM @a; EXECUTE s USING @b; END IF; end; $$ delim ; in PHP5, use mysqli to call the procedure, first arg is the query name, second, the search arg. Still don't know a good way to pass multiple arguments to mysql, so please let me know.