note 96391 deleted from function.mysql-real-escape-string by philip
| From: | philip@php.net | Date: | Fri, 04 Sep 2015 19:59:12 +0000 |
| Subject: | note 96391 deleted from function.mysql-real-escape-string by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-203664@lists.php.net to get a copy of this message | ||
Note Submitter: root at aeze dot ru
----
Here my simple but very effective function for safe mysql queries.
<?php
/**
* USAGE: mysql_safe( string $query [, array $params ] )
* $query - SQL query WITHOUT any user-entered parameters. Replace parameters with "?"
* e.g. $query = "SELECT date from history WHERE login = ?"
* $params - array of parameters
*
* Example:
* mysql_safe( "SELECT secret FROM db WHERE login = ?", array($login) ); # one parameter
* mysql_safe( "SELECT secret FROM db WHERE login = ? AND password = ?", array($login,
$password) ); # multiple parameters
* That will result safe query to MySQL with escaped $login and $password.
**/
function mysql_safe($query,$params=false) {
if ($params) {
foreach ($params as &$v) { $v = mysql_real_escape_string($v); } # Escaping parameters
# str_replace - replacing ? -> %s. %s is ugly in raw sql query
# vsprintf - replacing all %s to parameters
$sql_query = vsprintf( str_replace("?","'%s'",$query), $params );
$sql_query = mysql_query($sql_query); # Perfoming escaped query
} else {
$sql_query = mysql_query($query); # If no params...
}
return ($sql_query);
}
?>