Querying using array

Question

There is nothing wrong with my code, but I just cant help but wonder, should I wrap the $key with mysql_real_escape_string? This is just part of my Database function which is mainly used to pull data out of the database with table name and $where as arguments to the function. $where is to be an associative array with keys being column name, and values being the data.

This is what processes the $where array. Before this I have $sql = 'select * from ' . $table;

if(!empty($where)){
        $where_count = count($where);

        $sql .= ' WHERE ';

        foreach($where as $key => $value){

            $split_key = explode(' ', $key);

            if(count($split_key) > 1){
                $sql .= $key[0] . ' ' . $key[1] . ' "' . mysql_real_escape_string($value) . '" ';
            } else {
                $sql .= $key . ' = "' . mysql_real_escape_string($value) . '" ';
            }
        }
    }

Sgn. · Accepted Answer · 2012-03-01 21:54:40Z

1

Filter ANY INPUT from the user that is going to be placed in your query. No doubt!
So if the keys are supplied by the user, YES and if they are generated in a safe manner, NO.

Take a look at SQL Injection to understand why filtering must be done.

answered Mar 1, 2012 at 21:54

Sgn.

1,6962 gold badges14 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

David Lawrence Over a year ago

Thank you. The Keys are being generated by me, so I suppose i dont need to.

Treffynnon · Accepted Answer · 2012-03-01 21:54:45Z

1

I am not sure what is being asked here, but I can see one error:

$sql .= $key[0] . ' ' . $key[1] . ' "' . mysql_real_escape_string($value) . '" ';

should be

$sql .= $split_key[0] . ' ' . $split_key[1] . ' "' . mysql_real_escape_string($value) . '" ';

answered Mar 1, 2012 at 21:54

Treffynnon

21.6k6 gold badges68 silver badges99 bronze badges

1 Comment

David Lawrence Over a year ago

Thanks :) I totally didnt see that.

biziclop · Accepted Answer · 2012-03-01 22:02:39Z

1

If you really want to quote field names, use backticks.

See http://dev.mysql.com/doc/refman/5.6/en/identifiers.html

The following statement creates a table named a`b that contains a column named c"d:
CREATE TABLE `a``b` (`c"d` INT);

answered Mar 1, 2012 at 22:02

biziclop

14.6k3 gold badges52 silver badges66 bronze badges

1 Comment

David Lawrence Over a year ago

Dont understand how this has to do with my question, but thanks anyways dude or dudette.

Collectives™ on Stack Overflow

Querying using array

3 Answers 3

1 Comment

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related