mysql_paramquery(), to execute parametrized queries on MySQL in PHP - ΩJr. Software Articles and Products

function mysql_paramquery($sql, $sqlparams = array(), $dblink) {

  //A.E.Veltstra 2008

  //http://www.omegajunior.net/code/?id=mysql_paramquery

  //

  //Function parameters:

  //

  //$sql (string): sql statement using ? for parameter placeholders.

  //For instance: $sql = "select email from users where name='?' and userid=?";

  //We expect the developer to add quotes around the string parameters 

  //inside the sql statement as needed.

  

  //$sqlparams (array): holding the values to replace the placeholders.

  //The values must be provided in the same order as the placeholders.

  //For instance: $sqlparams = array($strUsername, $lngUserID);

  

  //$dblink (resource): MySQL database link, created with 'mysql_connect()'.



  //if there are any parameters, replace them with values. Otherwise, skip.

  if (is_array($sqlparams) && count($sqlparams) > 0 && strpos($sql, '?') > 0) {



      //Split our sql into parts exactly where the parameters need to go.

      $arrSQL = explode('?', $sql);

      //count the number of parts for the upcoming loops

      $c = count($arrSQL);

      //count the number of parameters for the upcoming loops

      $p = count($sqlparams);

      //set up the receiver

      $arrRes = array();

      

      //push array parts into the receiver until either source array runs out

      for ($i = 0; $i < $c && $i < $p; $i++) {

         $arrRes[] = array_shift($arrSQL);

         $arrRes[] = mysql_real_escape_string(array_shift($sqlparams));

      }

      

      //If all is well, there should be no more parts in the params array... 

      //but if there are, we don't care. The developer should care instead.

      //However, there may be more parts in the sql array. 

      //We need to push those into the receiver as well.

      //Since we already counted the number of parts, we can simply use a counting loop.

      

      while ($i < $c) {

          $arrRes[] = array_shift($arrSQL);

          $i++;

      }

      

      //Then we implode the receiver into a string

      $sql = implode('', $arrRes);

  }

  //execute the sql string

  return mysql_query($sql, $dblink);

}