a more efficient way to bind large insert and update

Question

a more efficient way to bind large insert and update

Navigation

#1 by (1 votes)

2

public function update($table, $data, $where,$criterios)
{

    $set = "";
    foreach ($data as $keyname => $value) {
        $set .= ($set == "") ? "" : ", ";
        $set .= $keyname . " = "  . ":".$keyname ;
    }

    $sql = "UPDATE $table SET $set WHERE $where";
    $stmt = $this->db->prepare($sql);

    foreach ($data as $placeholder => $valor) {
        $stmt->bindValue(":".$placeholder, $valor);
    }
    foreach ($criterios as $criterio => $valor) {
        $stmt->bindValue(":".$criterio, $valor);
    }
    return $stmt->execute();
}

update("tabelanome",$_POST,"WHERE :id=id",array("id"=>1));

Is there anything that can be done to make the code not vulnerable?

php pdo

asked by anonymous 12.05.2016 / 02:08

1 answer

Do not commit Specific line in GIT How to select a database blob and transform into bitmap?

score 1 · Answer 1

As a parameter to execute() , you can enter an array with the key / value relationship of the binding parameters. In this way, the array is only popular and pass as a method parameter. Example:

$bindingArray = array(
    ':bind1' => 'value1', 
    ':bind2' => 'value2'
);

$stmt->execute($bindingArray);