Php anti-SQL injection class (phppdo prevents SQL injection class)

Php anti-SQL injection class (phppdo prevents SQL injection class)

Class Model { Protected $ tableName = ""; // table name Protected $ pOb; // pdo class object Function _ construct (){ $ Pdo = new PDO ("mysql: host =". DB_HOST. "; dbname =". DB_NAME, DB_USERNAME, DB_PASSWORD ); $ Pdo-> exec ("set names". DB_CHARSET ); $ This-> pOb = $ pdo; } /* * Function: add * Parameter: array $ arr exp: array ('field name' => value, 'Field name' => value ,....) * Return: int | false */ Function add ($ arr ){ // Spell SQL statement $ KArr = array_keys ($ arr ); $ KStr = join (",", $ kArr ); $ VArr = array_values ($ arr ); $ PStr = ''; Foreach ($ vArr as $ s =>$ y ){ $ Vname = "p". $ s; $ PStr. = ':'. $ vname .','; } $ PStr = substr ($ pStr, 0,-1 ); $ SQL = "insert into {$ this-> tableName} ($ kStr) values ($ pStr )"; Print_r ($ SQL ); $ PdoS = $ this-> pOb-> prepare ($ SQL ); Foreach ($ vArr as $ k => $ y ){ $ Vname = "p". $ k; $ Vname = $ y; Var_dump ($ vname, $ vname ); $ PdoS-> bindParam (":". $ vname, $ vname, PDO: PARAM_STR ); } $ Re = $ pdoS-> execute (); If ($ re) {// Added successfully // Return the primary key id value Return $ this-> pOb-> lastInsertId (); } // Return value Return $ re; } Public function delete ($ arrWhere ){ If (! Empty ($ arrWhere )){ $ StrW = "where "; Foreach ($ arrWhere as $ kW => $ vW ){ $ Kn = str_replace (":", "", $ kW ); If (count ($ arrWhere) = 1 ){ $ StrW. = $ kn. "=". $ kW; } Else { $ StrW. = $ kn. "=". $ kW. "and "; } } If (count ($ arrWhere)> 1 ){ $ StrW. = "1 = 1 "; } } $ SQL = "delete from {$ this-> tableName}". $ strW; Print_r ($ SQL ); $ PdoS = $ this-> pOb-> prepare ($ SQL ); Foreach ($ arrWhere as $ kW => $ vW ){ $ Kn = str_replace (":", "", $ kW ); $ Kn = $ vW; If (is_int ($ vW )){ $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_INT ); } Else if (is_float ($ vW )){ $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_INT ); } Else { $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_STR ); } } $ Re = $ pdoS-> execute (); If ($ re ){ Return true; } Else { Return false; } } Function update ($ arrSet, $ arrWhere ){ // Spell SQL statement $ Str = ""; $ N = 0; Foreach ($ arrSet as $ kS =>$ ){ $ Str. = ",". $ kS. "=: p". $ n ++; } $ Str = substr ($ str, 1 ); Foreach ($ arrWhere as $ kW => $ vW ){ $ Kn = str_replace (":", "", $ kW ); If (count ($ arrWhere) = 1 ){ $ StrW. = $ kn. "=". $ kW; } Else { $ StrW. = $ kn. "=". $ kW. "and "; } } If (count ($ arrWhere)> 1 ){ $ StrW. = "1 = 1 "; } $ SQL = "update {$ this-> tableName} set {$ str} where". $ strW; // Print_r ($ SQL ); $ PdoS = $ this-> pOb-> prepare ($ SQL ); $ X = 0; Foreach ($ arrSet as $ kS =>$ ){ $ KS = ": p". $ x ++; $ KS = $; If (is_int ($ )){ $ PdoS-> bindParam ($ kS, $ kS, PDO: PARAM_INT ); } Else if (is_float ($ )){ $ PdoS-> bindParam ($ kS, $ kS, PDO: PARAM_INT ); } Else { $ PdoS-> bindParam ($ kS, $ kS, PDO: PARAM_STR ); } } Foreach ($ arrWhere as $ kW => $ vW ){ $ Kn = str_replace (":", "", $ kW ); $ Kn = $ vW; // $ p0 $ p1 $ p2 If (is_int ($ vW )){ $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_INT ); } Else if (is_float ($ vW )){ $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_INT ); } Else { $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_STR ); } } $ Re = $ pdoS-> execute (); If ($ re ){ Return true; } Else { Return false; } } // Query Function select ($ field = "*", $ ArrayWhere = "", $ order = "", $ limit = ""){ If (! Empty ($ ArrayWhere )){ $ StrW = "where "; Foreach ($ ArrayWhere as $ kW => $ vW ){ $ Kn = str_replace (":", "", $ kW ); If (count ($ ArrayWhere) = 1 ){ $ StrW. = $ kn. "=". $ kW; } Else { $ StrW. = $ kn. "=". $ kW. "and "; } } If (count ($ ArrayWhere)> 1 ){ $ StrW. = "1 = 1 "; } } If (! Empty ($ order )){ $ Order = "order by". $ order; } If (! Empty ($ limit )){ $ Limit = "limit". $ limit; } // Select field list from table name where condition order by field desc | asc limit start, length; $ SQL = "select {$ field} from {$ this-> tableName} {$ strW} {$ order} {$ limit }"; // Print_r ($ SQL ); $ PdoS = $ this-> pOb-> prepare ($ SQL ); If (! Empty ($ ArrayWhere )){ Foreach ($ ArrayWhere as $ kW => $ vW ){ $ Kn = str_replace (":", "", $ kW ); $ Kn = $ vW; If (is_int ($ vW )){ $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_INT ); } Else if (is_float ($ vW )){ $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_INT ); } Else { $ PdoS-> bindParam ($ kW, $ kn, PDO: PARAM_STR ); } } } $ Re = $ pdoS-> execute (); If ($ re ){ $ PdoS-> setFetchMode (PDO: FETCH_ASSOC ); Return $ pdoS-> fetchAll (); } Else { Return false; } } }