Prepared MYSQL statements

[MrMorph]

I'd like to use prepared MYSQL statements to insert data into the database, for added security.

I'm thinking smcFunc already does this, is that assumption correct? Nothing is mentioned in the docs that I can see.

[Kindred]

smcFunc sanitizes the SQL queries, yes

[All Colours Sam]

Yes, you can use prepared statements. They are a bit different than what you normally would do in PDO but the usage is almost the same:

Code Select Expand


$result = $smcFunc['db_query']('' ,'
     SELECT ppl.first_name, ppl.last_name, add.city, add.address
     FROM {db_prefix}people as ppl
          LEFT JOIN {db_prefix}addresses as add ON (add.id_address = ppl.id_address)
     WHERE ppl.id_person = {int:person}
          AND (ppl.middle_name = 'foo' OR ppl.suffix != 'jr')
          AND {bool:condition}',
     array(
         'person' => $id_person,
         'condition' => $condition,
     )
);


You can use the most common data types: int, string,array_int, array_string, date, float, identifier, etc.  Theres also the "raw" type for special cases where you might want to add raw SQL/data.



/Edit  16,000 posts! 

[MrMorph]

Great, thank you both