Hej alle,
jeg har nu arbejdet på en MySQL(i) klasse, der skal gøre det nemmere at sikre sine websider mod cross-site scripting og sql injections, så jeg vil gerne høre jeres mening. Indtil videre omfatter den kun Mysql men vil også komme til at omfatte MySQLi når jeg har fået mysql helt på plads.
interface.mysql.php
- interface MySQLInterface
- {
- public function __construct($db_host, $db_user, $db_pass, $db_data);
- public function connect();
- public function query($sql, $input = array(), $allowHTML = false);
-
- private function secureInput($input);
- }
class.mysql.php
- require_once('interface.mysql.php');
-
- class MySQLOldImplementation implements MySQLInterface
- {
- private $db_data, $db_host, $db_link, $db_pass, $db_user;
-
- public function __construct($host, $user, $pass, $data)
- {
- $this->db_host = $host;
- $this->db_user = $user;
- $this->db_pass = $pass;
- $this->db_data = $data;
-
- $this->connect();
- }
-
- public function __destruct()
- {
- mysql_close($this->db_link);
- }
-
- public function connect()
- {
- $this->db_link = mysql_connect($this->db_host, $this->db_user, $this->db_pass);
-
- mysql_select_db($this->db_data, $this->db_link);
- }
-
- public function fetchArray($result)
- {
- return mysql_fetch_array($result);
- }
-
- public function fetchAssoc($result)
- {
- return mysql_fetch_assoc($result);
- }
-
- public function fetchRow($result)
- {
- return mysql_fetch_row($result);
- }
-
- public function numRows($result)
- {
- return mysql_num_rows($result);
- }
-
- public function query($sql, $input = array(), $allowHTML = false)
- {
- $result = $this->createQuery($sql, $input, $allowHTML);
-
- return mysql_query($result, $this->db_link);
- }
-
- public function result($result, $row, $field = NULL)
- {
- return mysql_result($result, $row, $field);
- }
-
- private function createQuery($sql, $input = array(), $allowHTML)
- {
- $i = NULL;
- $sql_explode = explode("{0}", $sql);
-
- for($i = 0; $i < count($input); $i++)
- {
- if(!$allowHTML)
- $input[$i] = strip_tags($input[$i]);
- $query_string .= $sql_explode[$i] . ' ' . $this->secureInput($input[$i]);
- }
-
- if(count($input) < count($sql_explode))
- $query_string .= $sql_explode[$i++];
-
- return $query_string;
- }
-
- private function secureInput($input)
- {
- if(get_magic_quotes_gpc())
- $input = stripslashes($input);
-
- return mysql_real_escape_string($input);
- }
- }
mysql.php
- class MySQL
- {
- private static $class;
-
- public static function setInfo($db_host, $db_user, $db_pass, $db_data)
- {
- if(function_exists('mysql_connect'))
- {
- include('class.mysql.php');
- self::$class = new MySQLOldImplementation($db_host, $db_user, $db_pass, $db_data);
-
- return self::$class;
- }
- }
- }
Brugen af lib/classes:
Man opretter et object af klassen mysql og klassen mysql sørger så for at oprette et object til Mysql klassen eller Mysqli klassen.
Eks på query:
$mysql = MySQL::setInfo("host","user","pass","data");
$result = $mysql->query("INSERT INTO test(test1, test2) VALUES('{0}','{0}')", array('Hej','Hej2', false);
Har I spørgsmål så spørg endelig. Licens: Non-Commercial
Mvh Martin
Indlæg senest redigeret d. 27.09.2008 15:22 af Bruger #6559