Member Avatar for rhodoscoder

I found this code online and i want to understand it, i have read the php documentation but i have found out that the php programming community offers better explanations

PHP Code:
function mysql_safe_query($query) { 
   $args = array_slice(func_get_args(),1); 
   $args = array_map('mysql_safe_string',$args); 
   return mysql_query(vsprintf($query,$args)); 
   }

I figure the function isn't a builtin php function.array_slice returns a sequence of elements from the array func_get_args with an offset of 1.

I looked up func_get_args and it's supposed to return a copy of the given element(array? object)?? and I guess vsprintf returns a formatted string, removing the string quotations '' ??

  • 2 Contributors
  • 3 Replies
  • 230 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by rhodoscoder

Dani AI

Generated

A concise expert note that fills gaps in the thread and gives a safe, practical alternative.

The pattern shown in the original post builds an SQL string by formatting user-supplied values into the query and then executing it. That is fragile for several reasons: the escaping function (here named mysql_safe_string) is a black box and can be wrong; vsprintf only performs textual substitution (it does not add or remove SQL quotes or perform escaping); using func_get_args hides parameter intent and makes auditing harder; and the code relies on the old mysql_* API, which was removed from PHP core and should no longer be used. Those points echo 's critique but add why each is risky in practice (charset-dependent escaping, double-quoting, and hidden parameter types).

Prefer prepared statements and bound parameters. Prepared statements separate SQL from data so you do not need to escape values manually and you avoid a whole class of injection bugs. A minimal PDO example:

$pdo = new PDO('mysql:host=localhost;dbname=test;charset=utf8mb4', 'user', 'pass', [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email AND status = :status');
$stmt->execute([':email' => $email, ':status' => $status]);
$rows = $stmt->fetchAll();

Practical migration/troubleshooting tips for legacy code: search for all mysql_*, vsprintf-based SQL builders, and any custom "escape" wrappers; ensure connection charset is set (use utf8mb4); enable exceptions and query logging while testing; replace string-format queries with prepared statements incrementally. The OP, , was right to look into PDO — that is the right direction.

Recommended Answers

All 3 Replies

Member Avatar for jkon

Don’t look at it , it is a very bad coding example , the title of it could be “things you should never do”. In OOP PHP you never have to deal with function (few exceptions as fatal error calling functions)… The laughing part is func_get_args() , if you don’t know what arguments you pass to the method / function then you have problem. There are more on that as the calling function of mysql_safe_string that is made it wide open for anybody … PHP have solved that with many features as PDO … (there are others as well but I stick to PDO)… Bottom line that is a really lame code and everyone that suggest that one should be shamed.

Member Avatar for rhodoscoder

i realize that now, reading up on PDO

Member Avatar for rhodoscoder

thank you

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.