note 53400 added to function.mysql-query

Due to the easy ways SQL can be injected into websites and thus virtually ruin a website that is dependant on databasing, I created a 'prepare' function similar to the way sprintf works. <?php /* Wildcard Rules * SCALAR (?) => 'original string quoted' * OPAQUE (&) => 'string from file quoted' * MISC (~) => original string (left 'as-is') */ function prepare() { /* MySQL Prepare Function * By: Kage (Alex) * KageKonjou@GMail.com */ $data = func_get_args(); $query = $data[0]; $tokens = split("[\&\?\~]", $query); $preparedquery = $tokens[0]; $count = strlen($tokens[0]); for ($i=1; $i<count($tokens); $i++) { $char = substr($query, $count, 1); $count += (strlen($tokens[$i])+1); if ($char == "&") { $fp = @fopen($data[$i], 'r'); $pdata = ""; if ($fp) { while (($buf = fread($fp, 4096)) != false) { $pdata .= $buf; } fclose($fp); } } else { $pdata = &$data[$i]; } $preparedquery .= ($char != "~" ? mysql_escape_string($pdata) : $pdata); $preparedquery .= $tokens[$i]; } return $preparedquery; } ?> This function has been stress-tested, and does work. Example use: $prep_query = prepare("SELECT ?,? FROM ? WHERE '?' LIKE '&'", "lastname", "address", "addressbook", "lastname", "B%"); $prep_query now has the value of "SELECT lastname,address FROM addressbook WHERE 'lastname' LIKE 'B%'" In essence, as explained in the Wildcard Rules, ? is a quoted string, & is quoted from file, and ~ is raw ('AS-IS'). This function is to be used to make-safe SQL that is touched by a web interface. A main example would be forum pages (Ie. thread.php?fid=12&tid=12345). SQL could be injected at this point, such as " thread.php?fid=12&tid=12345'; DELETE FROM prefix_posts WHERE id LIKE '1%' ", which would essentially destroy that forum unless routine backups are made. This function, if used properly, can prevent any type of injections, turning the above injection into " thread.php?fid=12&tid=12345\'; DELETE FROM prefix_posts WHERE \id\ LIKE \'1%\' ", making it look for thread-id of everything from 12345 to 1%', making it a safe, though broken SQL. Comments and suggestions are welcome, and use of this function is free and under the Honor System (hoping you give credit where credit is due), since I'm too lazy to tack on a GNU. ---- Manual Page -- http://www.php.net/manual/en/function.mysql-query.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+53400 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+53400&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+53400&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+53400&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+53400&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+53400&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+53400&report=yes Search -- http://master.php.net/manage/user-notes.php