PHP Mysql Auto Quote?

Question

When inserting a row in mysql database, string values need to be enclosed in quotes where integer don't need to.

Is there any class or library that takes care of this automatically so that I can just pass to a 3rd-party function an array of fieldnames and values and don't have to worry about putting string values in quotes?

Thanks,

Answer 1

You need to worry about more than just quoting; you need to worry about SQL injection.

For new code, use PDO instead of the mysql_ or mysqli_ functions. Within PDO, use prepared statements (the PDOStatement object).

With prepared statements, you never have to enclose things in quotes and it stops SQL injections.

Answer 2

If you use PDO, then you do not need to worry about things like that.

Take a look at PDO::prepare for some examples.