使用具有不同数据类型的array_implode的数组mysql插入

Question

Hi i been trying to inserting array's into MySql database

The problem i am having is that i have different datatypes and sometime data can be a 0 value, having () curly brackets, percentage value with % sign. I would like to know a way use some already built php function that can deal with this issues.

So here is what i have done so far:

$t = array('country_code' => $data->country_code,   
           'Name' => $data->Name,
           'money' => $data->money,
           'chanceToDie' => $data->death,
           'age' => $cb->age)

/*  FORMAT EXAMPLE
    country_code = Africa (AF)
    name = jack
    chanceToDie = 5.5
    age = 62
*/

$columns = implode(", ",array_keys($t));

//Tried
$values = implode(", ",array_values($t));           //Dont work
$values = "'".implode("', '",array_values($t))."'";     //Dont work

$sql = "INSERT INTO table ($columns) VALUES ($values)";

Answer 1

You need to quote each individual value and use array_values() instead of array_keys() :

$values = '"' . implode('", "', array_values($t)) . '"';

However , this leaves you with an sql injection problem so you should really use a prepared statement.

In PDO you could use something like (assuming you control the keys and they are safe to use):

$values = ':' . implode(', :', array_keys($t));
// generates: ... VALUES(:country_code, :Name, :money,  // etc

Now you can prepare and execute your query using the array to bind the values to the placeholders. See for example http://php.net/manual/en/pdo.prepared-statements.php (the 6th example).

Answer 2

Try to use the advantage of PDO prepared queries - it is more safe and convinient.

Your code may look like this:

$col_names = array_keys($t);
// filter column names before inserting to sql to prevent sql injection
array_filter($col_names, function($v){return preg_relace("@\W@", "_", $v);});
// generate placeholders list: ?,?,?,?
$placeholders = implode(',', array_fill(0, count(t), "?"));
$values = array_values($t);

$q = $pdo->prepare('insert into (' . implode(",", $col_names) . ') values (' . $placeholders . ')');
$q->execute($values);

PDO will deal with data types and correctly replace every placeholder with the corresponding value.