php mysql real_escape_string用于整个查询

Question

Is it possible to escape a whole query instead of each searched field. For example I know I can do it like this:

$name="O'Connor";
$email="mark.O'Connor@something.com";

$name=mysql_real_escape_string($name);
$email=mysql_real_escape_string($email);

$query =("SELECT * FROM TABLE1 WHERE Name = '$name' OR Email = '$email' ");

// code to run query here 

What I am looking for is a way to build my query string like this :

$query=("SELECT * FROM TABLE1 WHERE Name = '$name' OR Email = '$email' ");
$query=mysql_real_escape_string($query); // Can I escape the whole Query ??

// code to run query here 

My reason for asking this Is I have a complex query which is using at around 15 variables from a form and I want to clean them all at once instead of using loads of mysql_real_escape($vairableName)...

Is this possible and can anyone exlplain how I can acheive this

Thanks in advance

Answer 1

You can't do that. Escaping changes characters with special meaning in SQL into escape sequences. You need some characters with special meaning so that the query can work. If you could just escape the entire query, then all database drivers would just do that automatically.

eg

$foo = "John O'Reilly";
$sql = "WHERE name='$foo'";
# There are three ' characters here, but only the middle one should be escaped

That said, you should stop using an obsolete database API and pick a modern replacement that supports prepared statements which will save you from having to call real_escape_string all over the place.

Answer 2

As others have pointed out, using prepared statements is the best way to go. But in case you still want to proceed ahead, you can do something like this:

foreach($_POST as $key=>$value)
{
   // this will take care of escaping all form elements
   $$key = mysql_real_escape_string($value);
}

So if your form contains 3 elements whose names are abc , def , and ghi , the above code will create variables named as $abc , $def , and $ghi respectively.

Then you can use them in query as before:

$query = "SELECT * FROM TABLE1 WHERE Name = '$abc' OR Email = '$def'";