extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2025-01-13 01:18:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

new function to do the complete type-dependent quoting of a value

Browse Source 
ToDo: need to write some introduction to the new SQL-inserting save functions of the db-class (inline docs are already there)
This commit is contained in:
Ralf Becker 2004-02-19 08:45:31 +00:00
parent a167a355a8
commit 35e9e09911
1 changed files with 31 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
phpgwapi/inc/class.db.inc.php
View File

@ -757,9 +757,38 @@
$this->connect();
}
/**
* Escape values before sending them to the database - prevents SQL injunction and SQL errors ;-)
*
* Please note that the quote function already returns necessary quotes: quote('Hello') === "'Hello'".
* Int and Auto types are casted to int: quote('1','int') === 1, quote('','int') === 0, quote('Hello','int') === 0
* @param mixed $value the value to be escaped
* @param string $type the type of the db-column, default False === varchar
* @return string escaped sting
*/
function quote($value,$type=False)
{
switch($type)
{
case 'int':
case 'auto':
return (int) $value;
}
// REMOVE-IF-ONLY-ADODB
if (!@$GLOBALS['phpgw_info']['server']['use_adodb'])
{
return "'" . (!isset($value) || $value == '' ? '' : addslashes($value)) . "'";
}
if (!$this->Link_ID)
{
$this->connect();
}
return $this->Link_ID->quote($value);
}
/**
* Implodes an array of column-value pairs for the use in sql-querys.
* All data is either run through addslashes() or (int).
* All data is run through quote (does either addslashes() or (int)) - prevents SQL injunction and SQL errors ;-).
*
* @author RalfBecker<at>outdoor-training.de
*
@ -784,9 +813,7 @@
if (!$only || in_array($key,$only))
{
$column_type = is_array($column_definitions) ? @$colum_definitions[$key]['type'] : False;
$values[] = ($use_key ? $key.'=' : '').
($column_type == 'int' || $colum_type == 'auto' ?
(int)$data : "'" . $this->db_addslashes($data) . "'");
$values[] = ($use_key ? $key.'=' : '') . $this->quote($data,$column_type);
}
}
return implode($glue,$values);