Changeset 5778 for trunk/wp-includes/wp-db.php

Timestamp:

07/04/2007 04:18:57 PM (19 years ago)

Author:

markjaquith

Message:

Introducing "prepare", a WPDB method for sprintf()-prepared SQL statements. see #4553. Implementation details to follow.

File:

• trunk/wp-includes/wp-db.php (modified) (1 diff)

trunk/wp-includes/wp-db.php

@@ -115 +115 @@
                 else
                         return mysql_real_escape_string( $string, $this->dbh );
+        }
+
+        /**
+         * Escapes content by reference for insertion into the database, for security
+         * @param string $s
+         */
+        function escape_by_ref(&$s) {
+                $s = $this->escape($s);
+        }
+
+        /**
+         * Prepares a SQL query for safe use, using sprintf() syntax
+         */
+        function prepare($args=NULL) {
+                if ( NULL === $args )
+                        return;
+                $args = func_get_args();
+                $query = array_shift($args);
+                array_walk($args, array(&$this, 'escape_by_ref'));
+                return @call_user_func_array('sprintf', array_merge(array($query), $args));
         }