note 39335 added to function.mysql-escape-string
| From: | ex0rzatwebdotde at rn2 dot php dot net | Date: | Sun, 25 Jan 2004 12:23:43 +0000 |
| Subject: | note 39335 added to function.mysql-escape-string | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-64132@lists.php.net to get a copy of this message | ||
I've written a example class, which escapes all query parameters:
<?php
class query {
var $_sql = '';
function query($sql)
{
$this->_sql = $sql;
return TRUE;
}
function query_params()
{
$params = func_get_args();
$params = array_map('mysql_escape_string', $params);
if (func_num_args() > 0) {
foreach ($params as $param) {
$this->_sql = preg_replace('/\?/', $param, $this->_sql, 1);
}
return TRUE;
} else {
return FALSE;
}
}
function execute()
{
if ($query = mysql_query($this->_sql)) {
return $query;
} else {
return FALSE;
}
}
}
function query($sql)
{
$obj = &new query($sql);
return $obj;
}
$query = query('SELECT user_id, user_name FROM users WHERE user = ? AND password = ?');
$query->query_params('John Doe', 'foobar');
$resid = $query->execute();
?>
cheers,
----
Manual Page -- http://www.php.net/manual/en/function.mysql-escape-string.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+39335
Delete -- http://master.php.net/manage/user-notes.php?action=delete+39335&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+39335&report=yes
Search -- http://master.php.net/manage/user-notes.php