note 96391 added to function.mysql-real-escape-string

Here my simple but very effective function for safe mysql queries. <?php /** * USAGE: mysql_safe( string $query [, array $params ] ) * $query - SQL query WITHOUT any user-entered parameters. Replace parameters with "?" * e.g. $query = "SELECT date from history WHERE login = ?" * $params - array of parameters * * Example: * mysql_safe( "SELECT secret FROM db WHERE login = ?", array($login) ); # one parameter * mysql_safe( "SELECT secret FROM db WHERE login = ? AND password = ?", array($login, $password) ); # multiple parameters * That will result safe query to MySQL with escaped $login and $password. **/ function mysql_safe($query,$params=false) { if ($params) { foreach ($params as &$v) { $v = mysql_real_escape_string($v); } # Escaping parameters # str_replace - replacing ? -> %s. %s is ugly in raw sql query # vsprintf - replacing all %s to parameters $sql_query = vsprintf( str_replace("?","'%s'",$query), $params ); $sql_query = mysql_query($sql_query); # Perfoming escaped query } else { $sql_query = mysql_query($query); # If no params... } return ($sql_query); } ?> ---- Server IP: 69.147.83.197 Probable Submitter: 79.111.78.24 ---- Manual Page -- http://www.php.net/manual/en/function.mysql-real-escape-string.php Edit -- https://master.php.net/note/edit/96391 Del: integrated -- https://master.php.net/note/delete/96391/integrated Del: useless -- https://master.php.net/note/delete/96391/useless Del: bad code -- https://master.php.net/note/delete/96391/bad+code Del: spam -- https://master.php.net/note/delete/96391/spam Del: non-english -- https://master.php.net/note/delete/96391/non-english Del: in docs -- https://master.php.net/note/delete/96391/in+docs Del: other reasons-- https://master.php.net/note/delete/96391 Reject -- https://master.php.net/note/reject/96391 Search -- https://master.php.net/manage/user-notes.php