Pseudo Prepared Statements for mysql_

Original - php Code <?php function mysql_prepared_query ($sql,$args=false,$con=false) { if($args) { if(is_array($args)) { $find = $replace = array(); foreach($args as $key => $val) { $find[] = ":".$key; if($con) { $replace[] = "'".mysql_real_escape_string($val,$con)."'"; } else { $replace[] = "'".mysql_real_escape_string($val)."'"; } } $sql = str_replace($find,$replace,$sql); } else { throw new Exception('If $args is supplied then it must be an array, '.gettype($args).' supplied'); } } //for debugging, comment out in production return $sql; if($con) { return mysql_query($sql,$con); } return mysql_query($sql); } $sql = " SELECT * FROM `table` WHERE `name` LIKE :name; OR `class` = :class ; "; $args['name'] = '%Northie%'; $args['class'] = 'User'; //debug echo mysql_prepared_query($sql,$args); $sql = " SELECT * FROM `table` WHERE `name` = :name; ; "; //debug echo mysql_prepared_query($sql,'Northie');

 
<?php
 
function mysql_prepared_query ($sql,$args=false,$con=false) {
    if($args) {
        if(is_array($args)) {
            $find = $replace = array();
            foreach($args as $key => $val) {
                $find[] = ":".$key;
                if($con) {
                    $replace[] = "'".mysql_real_escape_string($val,$con)."'";
                } else {
                    $replace[] = "'".mysql_real_escape_string($val)."'";
                }
            }
            
            $sql = str_replace($find,$replace,$sql);
            
        } else {
            throw new Exception('If $args is supplied then it must be an array, '.gettype($args).' supplied');
        }
    }
    
    //for debugging, comment out in production
    return $sql;
    
    if($con) {
        return mysql_query($sql,$con);
    }
    
    return mysql_query($sql);
}
 
$sql = "
    SELECT
        *
    FROM
        `table`
    WHERE
        `name` LIKE :name;
        OR
        `class` = :class
    ;
";
 
$args['name'] = '%Northie%';
$args['class'] = 'User';
 
//debug
echo mysql_prepared_query($sql,$args);
 
$sql = "
    SELECT
        *
    FROM
        `table`
    WHERE
        `name` = :name;
    ;
";
//debug
echo mysql_prepared_query($sql,'Northie');