well, i made a quick fix for using % in a query, i had to use preg_replace :| meh
function database_query() {
$args = func_get_args();
$q = array_shift($args); // remove first array entry
if (isset($args[0]) and is_array($args[0])) {
// Support for 'All arguments in one array' syntax
$args = $args[0];
}
$keys = explode('%', $q);
array_shift($keys);
$i = 0;
foreach($keys as &$el){
$i++;
$el = substr((string)$el,0,1)."$i"; // concatenated $i to make unique keys
}
if(isset($args) && count($args)!=0){
$args = array_combine($keys, $args);
foreach($args as $key => &$value){
$key = substr($key, 0, 1);
switch ($key) {
case 'd':
$value = $value; break;
case 's':
// WARNING: i am only using urlencode for testing without database interaction
// for testing with a database, replace urlencode with mysql_real_escape_string for example
$value = urlencode($value); break;
case 'n':
// Numeric values have arbitrary precision, so can't be treated as float.
$value = is_numeric($value) && !preg_match('/x/i', $value) ? $value : '0';
//well is_numeric() allows hex values (0xFF) but not valid.
break;
case 'f':
$value = (float)$value; break;
case 'b': // binary data
$value = "'".urlencode($value)."'"; break;
}
}
$q = preg_replace('/\(pc\)/', '%%', $q);
$q = vsprintf($q, $args);
echo $q;
}
else{
echo $q;
//mysql_query($q) if you are testing with database
}
}
//As a test
$uid = 5;
$name = "name";
$name1 = 'dido<d>';
database_query("SELECT FROM node (pc)WHERE text='%s' AND uid=%d AND name='%s'", $name1, $uid, $name); // (pc) is replaced by %.. dammit i had to use preg_replace after all :/
rolf wroteless code = less bugs
That's not necessarily true...
mysql_real_escape = no injection
okay so you're escaping numbers, hmmm... well you're happy with it :P
also a follow up for a previous question, you asked why i use mysql_real_escape_string instead of htmlentities for escaping html, well when you use htmlentities you do escape html but you won't be able to make other operations on it like strip_tags and you'll have those ugly tags showing in the comments on your website for example, or you'd have to decode, do operations, then encode which is quite unnecessary... i treat html as any normal text when entering to the database, the philosophy that i believe in is to store in as is(if type is correct) and filter out nasty stuff(e.g. xss attacks) on output
well i'll do some extended testing on these two functions, and benchmark them(when i have free time) and the current one i am using... w it's the only objective way to make a proper judgement, well anyway thanks again :) it's cool to have multiple options :D this thread had been/is a great fun(will continue to be :P)... i am going to open another thread for discussing how to prevent xss attacks
http://www.lebgeeks.com/forums/viewtopic.php?pid=22744#p22744, great to see others experiences in this subject
