note 40789 added to function.mysql-escape-string

<?php $query = "DELETE FROM user WHERE id=" . $id; mysql_query($query); ?> mysql_escape_string doesn't help here if we somehow get a param "5 OR 1=1" instead of simple 5. We'll end up with clear tab;e. I attempted to introduce a kind of type-safety into the SQL code via using of sprintf. The idea is in that the place of param binding is marked with %d or %s, so sprintf takes care of numerical params, and mysql_escape_string -- of strings: <?php> function query() { $aa = func_get_args(); foreach( $aa as $i => $val ) { if( $i == 0 ) continue; // format string if( is_string($val) ) { $val = mysql_escape_string($val); $aa[$i] = "'" . $val . "'"; } } $q = call_user_func_array('sprintf', $aa); $result = mysql_query($q) or die(mysql_error()); $ret = array(); while( $row = mysql_fetch_array($result) ) { $ret[] = $row; } return $ret; } ?> A call could look like: <?php $cat = SQL::query("delete from user where id=%d,$id); ?> ---- Manual Page -- http://www.php.net/manual/en/function.mysql-escape-string.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+40789 Delete -- http://master.php.net/manage/user-notes.php?action=delete+40789&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+40789&report=yes Search -- http://master.php.net/manage/user-notes.php