Changeset 906

Timestamp:

07/13/2007 11:27:06 PM (19 years ago)

Author:

mdawaffe

Message:

prepare() method for DB. See ​#WP4553

Location:

trunk/bb-includes

Files:

• db-mysqli.php (modified) (1 diff)
• db.php (modified) (1 diff)

trunk/bb-includes/db-mysqli.php

@@ -139 +139 @@
         function escape_deep( $array ) {
                 return is_array($array) ? array_map(array(&$this, 'escape_deep'), $array) : $this->escape( $array );
+        }
+
+        /**
+         * Escapes content by reference for insertion into the database, for security
+         * @param string $s
+         */
+        function escape_by_ref(&$s) {
+                $s = $this->escape($s);
+        }
+
+        /**
+         * Prepares a SQL query for safe use, using sprintf() syntax
+         */
+        function prepare($args=NULL) {
+                if ( NULL === $args )
+                        return;
+                $args = func_get_args();
+                $query = array_shift($args);
+                $query = str_replace("'%s'", '%s', $query); // in case someone mistakenly already singlequoted it
+                $query = str_replace('"%s"', '%s', $query); // doublequote unquoting
+                $query = str_replace('%s', "'%s'", $query); // quote the strings
+                array_walk($args, array(&$this, 'escape_by_ref'));
+                return @vsprintf($query, $args);
         }
 

trunk/bb-includes/db.php

@@ -132 +132 @@
         function escape_deep( $array ) {
                 return is_array($array) ? array_map(array(&$this, 'escape_deep'), $array) : $this->escape( $array );
+        }
+
+        /**
+         * Escapes content by reference for insertion into the database, for security
+         * @param string $s
+         */
+        function escape_by_ref(&$s) {
+                $s = $this->escape($s);
+        }
+
+        /**
+         * Prepares a SQL query for safe use, using sprintf() syntax
+         */
+        function prepare($args=NULL) {
+                if ( NULL === $args )
+                        return;
+                $args = func_get_args();
+                $query = array_shift($args);
+                $query = str_replace("'%s'", '%s', $query); // in case someone mistakenly already singlequoted it
+                $query = str_replace('"%s"', '%s', $query); // doublequote unquoting
+                $query = str_replace('%s', "'%s'", $query); // quote the strings
+                array_walk($args, array(&$this, 'escape_by_ref'));
+                return @vsprintf($query, $args);
         }