note 100501 deleted from function.vsprintf by danbrown

Note Submitter: marcovtwout at hotmail dot com ---- This is a function I wrote to combine vsprintf and mysql_real_escape_string to return safe queries. <?php /** * Returns safe database query. * Usage: prepareQuery("SELECT * FROM x WHERE y = %d'", $id) // single argument * Usage: prepareQuery("SELECT * FROM x WHERE y = %d AND z = '%s'", array($id, $string)) // multiple arguments * Usage: prepareQuery('SELECT * FROM x WHERE y = %2$d AND z = \'%1$s\'', array($string, $id)); //argument swapping * @see http://www.php.net/manual/en/function.sprintf.php * @see http://www.php.net/manual/en/function.vsprintf.php * @param string $sql String according to sprintf format * @param mixed $values single value or array with values * @return string safe query */ function prepareQuery($sql, $values = null) { // Convert single value to array if ($values != null && !is_array($values)) $values = array($values); if (count($values) > 0) { // Escape and replace values $values = array_map('mysql_real_escape_string', $values); $sql = vsprintf($sql, $values); } return $sql; } ?>