在php中为数组值添加引号

Question

以下脚本用于从多维数组中内插值并插入到mysql表中。该表包含varchar和decimal的字段数据类型。由于varchar类型需要引号并且为了避免选择性地放置引号，我想将所有值都放在引号中。如何实现呢？

$values = array();
foreach ($data as $rowValues) {
    foreach ($rowValues as $key => $rowValue) {
            }

    $values[] = "(" . implode(', ', $rowValues) . ",'".$date."')";
}

$query = "INSERT INTO mem (memno,loan,subsc,intst, date)
          VALUES " . implode (', ', $values);
$result=mysql_query($query) or die();

我想要像这样的SQL

INSERT INTO mem (memno,loan,subsc,intst, date)
values('value1', 'value2', 'valu3','value4','value5')

Answer 1

不要使用用户输入来构建SQL字符串 - 这就是你如何获得SQL注入攻击。

而是使用a prepared statement：

$mysqli = new mysqli('localhost', 'my_user', 'my_password', 'world');

$stmt = $mysqli->prepare("
    INSERT INTO mem( memno, loan, subsc, intst, date )
        VALUES (?, ?, ?, ?, ?);
");
$stmt->bind_param('sssss', $memno, $loan, $subsc, intst, $date);

编辑以回复评论：

使用PDO动态绑定列数组非常容易。

$db =new PDO("mysql:host=localhost;dbname=database;","root","");

/**
* @param PDO $db
* @param string $table - the table to insert into
* @param array $columns - which columns do we want to insert into
* @param array $data - a key/value array of the data we want to insert
* @return bool
*/
function insert_into($db, $table, array $columns, array $data) {
    $rows = implode(', ', $fields);
    $placeholders = array_map ( function($key){ return ":$key" }, $fields); 
    $placeholders = implode(', ', $fields);

    $sql = "
        INSERT INTO $table ($fields)
        VALUES ($placeholders);
    ";

    $stmt = $db->prepare($sql);

    foreach( $fields as $field) {
        $stmt->bindParam(":$field", $data[$field]);
    }

    return $sth->execute();
}

$inserted = insertInto(
    $db
    'mem',
    array("memno", "loan", "subsc", "intst", "date"),
    $data
);

请注意，要插入的列是单独定义的。 如果我使用过：

array_keys($data);

如果$data来自用户输入且未列入白名单，则会导致mass assigment vulnerability。

你可以用mysqli完成同样的事情，但它有点棘手。

Answer 2

如果$ rowValues数组如下所示，那么你也可以这样做。

$rowValues = array(
  "memno"=>"a",
  "loan"=>"b",
  "subsc"=>"c",
  "intst"=>"d"
);

$fldStr = array();
$valStr = array();
foreach($rowValues as $key=>$val) {
  array_push($fldStr, $key);
  $v2 = "'" . $val . "'";
  array_push($valStr, $v2);
}
array_push($fldStr, "date");
array_push($valStr, "'" . $date . "'");

$flds = implode(", ", $fldStr);
$vals = implode(", ", $valStr);

$query = "INSERT INTO mem ($flds) values($vals)";