Php anti-Injection

When you look at a program, you can see this write and record it:

Function prepare_query ($ SQL, $ params = null)
{
$ SQL _block = explode ("? ", $ SQL );
$ Sp_size = sizeof ($ SQL _block)-1;
$ Param_size = sizeof ($ params );
 
If ($ sp_size = 0 & $ params = null)
Return $ SQL;
 
If ($ sp_size <1) | ($ param_size <1) | ($ sp_size! = $ Param_size ))
Return "";
 
If ($ param_size = 1)
{
If (gettype ($ params) = string)
{
$ Result = str_replace (?, "". $ Params. "", $ SQL );
}
Else if (gettype ($ params) = integer)
{
$ Result = str_replace (?, $ Params, $ SQL );
}
}
Else if ($ param_size> 1)
{
For ($ I = 0; $ I <sizeof ($ params); $ I ++)
{
If (gettype ($ params [$ I]) = string)
$ SQL _block [$ I]. = "". $ params [$ I]. "";
Else if (gettype ($ params [$ I]) = integer)
$ SQL _block [$ I]. = $ params [$ I];
}
 
$ Result = "";
For ($ I = 0; $ I <$ param_size; $ I ++)
{
$ Result. = $ SQL _block [$ I];
}
}
 
Return $ result;
}

Reprinted Please note: woyiguis blog