note 97933 deleted from function.mysql-real-escape-string by philip
| From: | philip@php.net | Date: | Fri, 04 Sep 2015 20:01:52 +0000 |
| Subject: | note 97933 deleted from function.mysql-real-escape-string by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-203671@lists.php.net to get a copy of this message | ||
Note Submitter: manixrock -~- gmail ~-~ com
----
I've come up with an easy way to more easily escape things in an sql query. The simpler things
are, the lower the chance that you'll forget to escape something. I use a helper class:
<?php
class MysqlStringEscaper
{
function __get($value)
{
return mysql_real_escape_string($value);
}
}
$str = new MysqlStringEscaper;
?>
then whenever I run a query I can simply do:
<?php
mysql_query("SELECT * FROM users WHERE name LIKE '{$str->$name}' LIMIT 10");
?>
This way it's easy to see what the variable is escaped as (other instances like $int or $list
could be implemented), it's inline and it only changes the variable when it's inserted
into the query.