note 99945 modified in function.mysql-real-escape-string by danbrown
| From: | danbrown@php.net | Date: | Thu, 16 Sep 2010 15:46:55 +0000 |
| Subject: | note 99945 modified in function.mysql-real-escape-string by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-172650@lists.php.net to get a copy of this message | ||
You can also use the escape function in a manner as shown in the snapshot out of my own browsertools
class:
<?php
//
// MySQL Database connection
//
public function mysqlConnect($host, $user, $password, $database) {
$this->mysql = mysql_connect($host, $user, $password);
if (!$this->mysql) die(mysql_error());
mysql_select_db($database, $this->mysql);
}
//
// MySQL Query
// usage:
// $query such as "SELECT * FROM users WHERE nick = '%s' AND pass =
'%s'"
// where %s are the placeholders for the parameters
// call:
// $__->mysqlQuery( $query, arg0, arg1, arg2, ... )
// description:
// The parameters given to the function are escaped through mysql_real_escape_string(),
// merged with the query and then given to the mysql_query function.
// returns:
// Array of lines returned by the MySQL Database
//
public function mysqlQuery($query) {
$numParams = func_num_args();
$params = func_get_args();
if ($numParams > 1) {
for ($i = 1; $i < $numParams; $i++){
$params[$i] = mysql_real_escape_string($params[$i]);
}
$query = call_user_func_array('sprintf', $params);
}
$this->result = mysql_query($query, $this->mysql);
if (!$this->result) die(mysql_error());
$ret = array();
while ($row = mysql_fetch_assoc($this->result)) {
$ret[] = $row;
}
mysql_free_result($this->result);
return $ret;
}
?>
--was--
You can also use the escape function in a manner as shown in the snapshot out of my own browsertools
class:
//
// MySQL Database connection
//
public function mysqlConnect($host, $user, $password, $database) {
$this->mysql = mysql_connect($host, $user, $password);
if (!$this->mysql) die(mysql_error());
mysql_select_db($database, $this->mysql);
}
//
// MySQL Query
// usage:
// $query such as "SELECT * FROM users WHERE nick = '%s' AND pass =
'%s'"
// where %s are the placeholders for the parameters
// call:
// $__->mysqlQuery( $query, arg0, arg1, arg2, ... )
// description:
// The parameters given to the function are escaped through mysql_real_escape_string(),
// merged with the query and then given to the mysql_query function.
// returns:
// Array of lines returned by the MySQL Database
//
public function mysqlQuery($query) {
$numParams = func_num_args();
$params = func_get_args();
if ($numParams > 1) {
for ($i = 1; $i < $numParams; $i++){
$params[$i] = mysql_real_escape_string($params[$i]);
}
$query = call_user_func_array('sprintf', $params);
}
$this->result = mysql_query($query, $this->mysql);
if (!$this->result) die(mysql_error());
$ret = array();
while ($row = mysql_fetch_assoc($this->result)) {
$ret[] = $row;
}
mysql_free_result($this->result);
return $ret;
}
http://php.net/manual/en/function.mysql-real-escape-string.php