PHP Anti-SQL injection class (PHP PDO prevents SQL injection classes)

Class model{ protected $tableName = "";//Table name protected $pOb;//pdo class object function __construct () { $pdo =new PDO ("mysql:host="). Db_host. "; Dbname= ". Db_name,db_username,db_password); $pdo->exec ("Set Names"). Db_charset); $this->pob= $pdo; } /* * Function: Increase * Parameters: Array $arr exp:array (' field name ' = = value, ' field name ' = = value,....) * Return:int|false */ function Add ($arr) { Spelling SQL statements $KARR =array_keys ($arr); $kStr =join (",", $KARR); $VARR =array_values ($arr); $PSTR = "; foreach ($vArr as $s = = $y) { $vname = "P". $s; $pStr. = ': '. $vname. ', '; } $PSTR = substr ($pStr, 0,-1); $sql = "INSERT INTO {$this->tablename} ($KSTR) VALUES ($PSTR)"; Print_r ($sql); $pdoS = $this->pob->prepare ($sql); foreach ($vArr as $k = = $y) { $vname = "P". $k; $ $vname = $y; Var_dump ($vname, $ $vname); $pdoS-Bindparam (":". $vname, $ $vname, PDO::P aram_str); } $re = Execute () $pdoS; if ($re) {//Added successfully Returns the primary Key ID value return $this->pob->lastinsertid (); } return value return $re; } Public Function Delete ($arrWhere) { if (!empty ($arrWhere)) { $strW = "where"; foreach ($arrWhere as $kW = = $vW) { $KN = Str_replace (":", "", $kW); if (count ($arrWhere) ==1) { $strW. = $kn. " = ". $kW; }else{ $strW. = $kn. " = ". $kW." and "; } } if (count ($arrWhere) >1) { $strW. = "1=1"; } } $sql = "Delete from {$this->tablename}". $strW; Print_r ($sql); $pdoS = $this->pob->prepare ($sql); foreach ($arrWhere as $kW = = $vW) { $KN = Str_replace (":", "", $kW); $ $kn = $vW; if (Is_int ($vW)) { $pdoS->bindparam ($kW, $ $kn, PDO::P aram_int); }else if (is_float ($vW)) { $pdoS->bindparam ($kW, $ $kn, PDO::P aram_int); }else{ $pdoS->bindparam ($kW, $ $kn, PDO::P aram_str); } } $re = $pdoS->execute (); if ($re) { return true; }else { return false; } } function Update ($arrSet, $arrWhere) { Spelling SQL statements $str = ""; $n = 0; foreach ($arrSet as $kS = = $vS) { $str. = ",". $kS. " =:p ". $n + +; } $str = substr ($str, 1); foreach ($arrWhere as $kW = = $vW) { $kn =str_replace (":", "", $kW); if (count ($arrWhere) ==1) { $strW. = $kn. " = ". $kW; }else{ $strW. = $kn. " = ". $kW." and "; } } if (count ($arrWhere) >1) { $strW. = "1=1"; } $sql = "Update {$this->tablename} set {$str} where". $strW; Print_r ($sql); $pdoS = $this->pob->prepare ($sql); $x = 0; foreach ($arrSet as $kS = = $vS) { $kS = ":p". $x + +; $ $kS = $vS; if (Is_int ($vS)) { $pdoS->bindparam ($kS, $ $kS, PDO::P aram_int); }else if (is_float ($vS)) { $pdoS->bindparam ($kS, $ $kS, PDO::P aram_int); }else{ $pdoS->bindparam ($kS, $ $kS, PDO::P aram_str); } } foreach ($arrWhere as $kW = = $vW) { $kn =str_replace (":", "", $kW); $ $kn = $vW;//$p 0 $p 1 $p 2 if (Is_int ($vW)) { $pdoS->bindparam ($kW, $ $kn, PDO::P aram_int); }else if (is_float ($vW)) { $pdoS->bindparam ($kW, $ $kn, PDO::P aram_int); }else{ $pdoS->bindparam ($kW, $ $kn, PDO::P aram_str); } } $re = $pdoS->execute (); if ($re) { return true; }else{ return false; } } Check function Select ($field = "*", $ArrayWhere = "", $order = "", $limit = "") { if (!empty ($ArrayWhere)) { $strW = "where"; foreach ($ArrayWhere as $kW = = $vW) { $kn =str_replace (":", "", $kW); if (count ($ArrayWhere) ==1) { $strW. = $kn. " = ". $kW; }else{ $strW. = $kn. " = ". $kW." and "; } } if (count ($ArrayWhere) >1) { $strW. = "1=1"; } } if (!empty ($order)) { $order = "ORDER by". $order; } if (!empty ($limit)) { $limit = "Limit". $limit; } Select field List from table name where Condition order by field DESC|ASC limit start,length; $sql = "Select {$field} from {$this->tablename} {$strW} {$order} {$limit}"; Print_r ($sql); $pdoS = $this->pob->prepare ($sql); if (!empty ($ArrayWhere)) { foreach ($ArrayWhere as $kW = = $vW) { $kn =str_replace (":", "", $kW); $ $kn = $vW; if (Is_int ($vW)) { $pdoS->bindparam ($kW, $ $kn, PDO::P aram_int); }else if (is_float ($vW)) { $pdoS->bindparam ($kW, $ $kn, PDO::P aram_int); }else{ $pdoS->bindparam ($kW, $ $kn, PDO::P aram_str); } } } $re = $pdoS->execute (); if ($re) { $pdoS->setfetchmode (PDO::FETCH_ASSOC); return $pdoS->fetchall (); }else { return false; } } } Copy Code

