note 42613 added to function.pg-insert
| From: | mina86 at tlen dot pl | Date: | Sun, 23 May 2004 22:24:34 +0000 |
| Subject: | note 42613 added to function.pg-insert | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-70001@lists.php.net to get a copy of this message | ||
Next version :) My version checks whether value is bool, null, string or numeric and if one of the
values is not function returns false if not. null values are inserted as NULL, bool as true or false
and strings are add-shlashed before adding to query string. Note, that this function is not safe.
SQL injection is possible with column names if you use $_POST or something similar as a $array.
<?php
function db_build_insert($table, $array) {
if (count($array)===0) return false;
$columns = array_keys($array);
$values = array_values($array);
unset($array);
for ($i = 0, $c = count($values); $i$c; ++$i) {
if (is_bool($values[$i])) {
$values[$i] = $values[$i]?'true':'false';
} elseif (is_null($values[$i])) {
$values[$i] = 'NULL';
} elseif (is_string($values[$i])) {
$values[$i] = "'" . addslashes($values[$i]) . "'";
} elseif (!is_numeric($values[$i])) {
return false;
}
}
return "INSERT INTO $table ($column_quote" . implode(', ', $columns) .
") VALUES (" . implode(', ', $values) . ")";
}
?>
----
Manual Page -- http://www.php.net/manual/en/function.pg-insert.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+42613
Delete -- http://master.php.net/manage/user-notes.php?action=delete+42613&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+42613&report=yes
Search -- http://master.php.net/manage/user-notes.php