Changeset 5778

Timestamp:

07/04/2007 04:18:57 PM (17 years ago)

Author:

markjaquith

Message:

Introducing "prepare", a WPDB method for sprintf()-prepared SQL statements. see #4553. Implementation details to follow.

File:

• trunk/wp-includes/wp-db.php (modified) (1 diff)

trunk/wp-includes/wp-db.php

@@ -115 +115 @@
         else
             return mysql_real_escape_string( $string, $this->dbh );
+    }
+
+    /**
+     * Escapes content by reference for insertion into the database, for security
+     * @param string $s
+     */
+    function escape_by_ref(&$s) {
+        $s = $this->escape($s);
+    }
+
+    /**
+     * Prepares a SQL query for safe use, using sprintf() syntax
+     */
+    function prepare($args=NULL) {
+        if ( NULL === $args )
+            return;
+        $args = func_get_args();
+        $query = array_shift($args);
+        array_walk($args, array(&$this, 'escape_by_ref'));
+        return @call_user_func_array('sprintf', array_merge(array($query), $args));
     }