note 39335 deleted from function.mysql-escape-string by nlopess
| From: | nlopess@php.net | Date: | Sun, 25 Jan 2004 12:24:20 +0000 |
| Subject: | note 39335 deleted from function.mysql-escape-string by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-64133@lists.php.net to get a copy of this message | ||
Note Submitter: ex0rz at web dot de
----
I've written a example class, which escapes all query parameters:
<?php
class query {
var $_sql = '';
function query($sql)
{
$this->_sql = $sql;
return TRUE;
}
function query_params()
{
$params = func_get_args();
$params = array_map('mysql_escape_string', $params);
if (func_num_args() > 0) {
foreach ($params as $param) {
$this->_sql = preg_replace('/\?/', $param, $this->_sql, 1);
}
return TRUE;
} else {
return FALSE;
}
}
function execute()
{
if ($query = mysql_query($this->_sql)) {
return $query;
} else {
return FALSE;
}
}
}
function query($sql)
{
$obj = &new query($sql);
return $obj;
}
$query = query('SELECT user_id, user_name FROM users WHERE user = ? AND password = ?');
$query->query_params('John Doe', 'foobar');
$resid = $query->execute();
?>
cheers,