note 112641 added to book.pdo

Merge the prepare() and execute() in one function like a sprintf(). And like sprintf, I choose to use unnamed args (?) ;) you could still use old insecure query() ( not prepared ) with renamed function :) <?php class MyPDO extends PDO{ const PARAM_host='localhost'; const PARAM_port='3306'; const PARAM_db_name='test'; const PARAM_user='root'; const PARAM_db_pass=''; public function __construct($options=null){ parent::__construct('mysql:host='.MyPDO::PARAM_host.';port='.MyPDO::PARAM_port.';dbname='.MyPDO::PARAM_db_name, MyPDO::PARAM_user, MyPDO::PARAM_db_pass,$options); } public function query($query){ //secured query with prepare and execute $args = func_get_args(); array_shift($args); //first element is not an argument but the query itself, should removed $reponse = parent::prepare($query); $reponse->execute($args); return $reponse; } public function insecureQuery($query){ //you can use the old query at your risk ;) and should use secure quote() function with it return parent::query($query); } } $db = new MyPDO(); $db->setAttribute(PDO::ATTR_DEFAULT_FETCH_MODE, PDO::FETCH_OBJ); $t1 = isset($_GET["t1"])?$_GET["t1"]:1; // need to be securised for injonction $t2 = isset($_GET["t2"])?$_GET["t2"]:2; // need to be securised for injonction $t3 = isset($_GET["t3"])?$_GET["t3"]:3; // need to be securised for injonction $ret = $db->query("SELECT * FROM table_test WHERE t1=? AND t2=? AND t3=?",$t1,$t2,$t3); //$ret = $db->insecureQuery("SELECT * FROM table_test WHERE t1=".$db->quote($t1)); while ($o = $ret->fetch()) { echo $o->nom.PHP_EOL; } ?> ---- Server IP: 69.147.83.199 Probable Submitter: 82.226.97.114 ---- Manual Page -- http://php.net/manual/en/book.pdo.php Edit -- https://master.php.net/note/edit/112641 Del: integrated -- https://master.php.net/note/delete/112641/integrated Del: useless -- https://master.php.net/note/delete/112641/useless Del: bad code -- https://master.php.net/note/delete/112641/bad+code Del: spam -- https://master.php.net/note/delete/112641/spam Del: non-english -- https://master.php.net/note/delete/112641/non-english Del: in docs -- https://master.php.net/note/delete/112641/in+docs Del: other reasons-- https://master.php.net/note/delete/112641 Reject -- https://master.php.net/note/reject/112641 Search -- https://master.php.net/manage/user-notes.php