note 92159 modified in function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Mon, 13 Jul 2009 15:58:27 +0000 |
| Subject: | note 92159 modified in function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-158233@lists.php.net to get a copy of this message | ||
I had wanted to see the merits of dynamically and "automatically" applying
mysql_real_escape_string() to $_GET and $_POST as arrays rather than manually each time I would type
up a query. I used array_walk_recursive() to call my function "mysql_safe" to apply
mysql_real_escape_string() to each key of the $_GET and $_POST arrays.
My function is part of a class, and it is called each time I connect to the database to perform a
query:
<?php
class MyClass {
function mysql_safe ( $key, $item, $type )
{
switch( $type )
{
case 'get':
if( count( $_GET ) > 0 )
{
$_GET[$item] = mysql_real_escape_string( $key );
}
break;
case 'post':
if( count( $_POST ) > 0 )
{
$_POST[$item] = mysql_real_escape_string( $key );
}
break;
}
}
function safe_get ( )
{
#Flag to only run function once
if( $this->get_flag == true ) { return true; }
array_walk_recursive( $_GET, array( $this, 'mysql_safe' ), 'get' );
array_walk_recursive( $_POST, array( $this, 'mysql_safe' ), 'post' );
$this->get_flag = true;
}
}
?>
However, after using this function, I find that it does indeed work, it also creates new $_GET and
$_POST values in which $item and $key are swapped. So I end up with $_GET[$item] = $key, as well as
$_GET[$key] = $item. I have not yet determined if this is due to the actual coding itself, or my
particular method of implementation.
[EDIT BY danbrown AT php DOT net: Contains a bugfix by "Anonymous" on 13-JUL-09 to reorder
the user function parameters.]
--was--
I had wanted to see the merits of dynamically and "automatically" applying
mysql_real_escape_string() to $_GET and $_POST as arrays rather than manually each time I would type
up a query. I used array_walk_recursive() to call my function "mysql_safe" to apply
mysql_real_escape_string() to each key of the $_GET and $_POST arrays.
My function is part of a class, and it is called each time I connect to the database to perform a
query:
<?php
class MyClass {
function mysql_safe ( $item, $key, $type )
{
switch( $type )
{
case 'get':
if( count( $_GET ) > 0 )
{
$_GET[$item] = mysql_real_escape_string( $key );
}
break;
case 'post':
if( count( $_POST ) > 0 )
{
$_POST[$item] = mysql_real_escape_string( $key );
}
break;
}
}
function safe_get ( )
{
#Flag to only run function once
if( $this->get_flag == true ) { return true; }
array_walk_recursive( $_GET, array( $this, 'mysql_safe' ), 'get' );
array_walk_recursive( $_POST, array( $this, 'mysql_safe' ), 'post' );
$this->get_flag = true;
}
}
?>
However, after using this function, I find that it does indeed work, it also creates new $_GET and
$_POST values in which $item and $key are swapped. So I end up with $_GET[$item] = $key, as well as
$_GET[$key] = $item. I have not yet determined if this is due to the actual coding itself, or my
particular method of implementation.
http://php.net/manual/en/function.mysql-real-escape-string.php