note 13475 deleted from function.str-replace by philip
| From: | philip@php.net | Date: | Mon, 04 Feb 2002 12:50:40 +0000 |
| Subject: | note 13475 deleted from function.str-replace by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-26218@lists.php.net to get a copy of this message | ||
I was tring to find anything where I could parse many variables that a user entered to mySQL. It
basically takes out all the stupid little things that cause problems.
what is entered is:
te\st
t'est2
// USER ENTERED VARS
// ADD AS MANY AS YOU LIKE
$dbvars = array("te\st", "test2<>");
// FIND THESE IN VAR
// ADD MORE THINGS TO REPLACE BUT
// MAKE SURE YOU ADD TO dbreplace ARRAY TO
$dbfind = array("\\", "'", "<", ">");
// REPLACE WITH WHAT IT FOUND
$dbreplace = array("\\\\", "\'", "", "");
$num_vars = count ($dbvars);
$num_find = count ($dbfind);
$num_replace = count ($dbreplace);
for ($id=0; $id < $num_vars; ++$id) {
for ($idstr=0; $idstr < $num_find; ++$idstr) {
$dbvars[$id] = str_replace("$dbfind[$idstr]", "$dbreplace[$idstr]",
$dbvars[$id]);
}
echo ("$dbvars[$id]<br>");
}
what is returned is so you can put in to db:
te\\st
t\'est2
Let me know if there is a problem with this or a way to optimize it.