PHP Database::quote方法代码示例

 public function __toString()
 {
     $data = $this->_compile();
     foreach ($data['values'] as $v) {
         $data['sql'] = preg_replace('/\\?/', $this->_database->quote($v), $data['sql'], 1);
     }
     return $data['sql'];
 }

 /**
  * Compiles the current object into a string.
  *
  * @param	string	The column name.
  * @param	string	The operator used in the conditional statement.
  * @param	object	The value to compare the column with.
  * @return	Database_Constraint_Check	The current object.
  */
 protected function _compile_check(array $data, Database $db)
 {
     // We have a keyword
     if (is_array(reset($data))) {
         // AND or OR
         $keyword = key(reset($data));
         // Compile the check params into a single string
         return $keyword . ' ' . $db->quote_identifier($data[0]) . ' ' . $data[1] . ' ' . $db->quote($data[2]);
     } else {
         // Compile the check params into a single string
         return $db->quote_identifier($data[0]) . ' ' . $data[1] . ' ' . $db->quote($data[2]);
     }
 }

 private function startQuery($search_string)
 {
     $database = new Database();
     $database->Create(new EventTable());
     /*
                 
                $sqlFullText= "CREATE FULLTEXT INDEX If Not Exists search ON ".EventTable::TableName.
                        "(".EventTable::Title.",".
                         EventTable::Description.",".
                         EventTable::SeachableKeywords.",".
                         EventTable::Venue.")";
                 
                  * ".EventTable::Title, "(".EventTable::Title.","
                           .EventTable::Description.",".EventTable::SeachableKeywords.",".EventTable::Venue."
                  * 
                 $database->runCommand($sqlFullText);
                  * */
     $query_string = $database->quote($search_string);
     $squery = "select *from " . EventTable::TableName . " WHERE ( MATCH (" . EventTable::Title . "," . EventTable::Description . "," . EventTable::SeachableKeywords . "," . EventTable::Venue . ") AGAINST ({$query_string} IN BOOLEAN MODE)) AND " . EventTable::Status . " > :zero";
     $stmt = $database->prepare($squery);
     $stmt->bindValue(":zero", 0);
     $status = $stmt->execute();
     if ($status) {
         $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
         for ($i = 0; $i < count($rows); $i++) {
             $rows[$i][EventTable::Image] = IMAGE_EVENT_PATHS . $rows[$i][EventTable::Image];
         }
         return $rows;
     } else {
         print_r($stmt->errorInfo());
         return null;
     }
 }

 /**
  * Compiles an array of conditions into an SQL partial. Used for WHERE
  * and HAVING.
  *
  * @param   object  Database instance
  * @param   array   condition statements
  * @return  string
  */
 public static function compile_conditions(Database $db, array $conditions)
 {
     $last_condition = NULL;
     $sql = '';
     foreach ($conditions as $group) {
         // Process groups of conditions
         foreach ($group as $logic => $condition) {
             if ($condition === '(') {
                 if (!empty($sql) and $last_condition !== '(') {
                     // Include logic operator
                     $sql .= ' ' . $logic . ' ';
                 }
                 $sql .= '(';
             } elseif ($condition === ')') {
                 $sql .= ')';
             } else {
                 if (!empty($sql) and $last_condition !== '(') {
                     // Add the logic operator
                     $sql .= ' ' . $logic . ' ';
                 }
                 // Split the condition
                 list($column, $op, $value) = $condition;
                 // Append the statement to the query
                 $sql .= $db->quote_identifier($column) . ' ' . strtoupper($op) . ' ' . $db->quote($value);
             }
             $last_condition = $condition;
         }
     }
     return $sql;
 }

 /**
  * Check if a table exists in the (sqlite) database.
  *
  * @param string $table
  * @return bool
  */
 private function tableExists($table)
 {
     static $tables = array();
     if (isset($tables[$table]) === false) {
         $tables[$table] = (bool) self::$database->fetchValue('SELECT count(*) FROM sqlite_master WHERE type="table" AND name=' . self::$database->quote($table));
     }
     return $tables[$table];
 }

 /**
  * Compiles an array of conditions into an SQL partial. Used for WHERE
  * and HAVING.
  *
  * @param   object  Database instance
  * @param   array   condition statements
  * @return  string
  */
 public static function compile_conditions(Database $db, array $conditions)
 {
     $last_condition = NULL;
     $sql = '';
     foreach ($conditions as $group) {
         // Process groups of conditions
         foreach ($group as $logic => $condition) {
             if ($condition === '(') {
                 if (!empty($sql) and $last_condition !== '(') {
                     // Include logic operator
                     $sql .= ' ' . $logic . ' ';
                 }
                 $sql .= '(';
             } elseif ($condition === ')') {
                 $sql .= ')';
             } else {
                 if (!empty($sql) and $last_condition !== '(') {
                     // Add the logic operator
                     $sql .= ' ' . $logic . ' ';
                 }
                 // Split the condition
                 list($column, $op, $value) = $condition;
                 // Database operators are always uppercase
                 $op = strtoupper($op);
                 if ($op === 'BETWEEN' and is_array($value)) {
                     // BETWEEN always has exactly two arguments
                     list($min, $max) = $value;
                     // Quote the min and max value
                     $value = $db->quote($min) . ' AND ' . $db->quote($max);
                 } else {
                     // Quote the entire value normally
                     $value = $db->quote($value);
                 }
                 // Append the statement to the query
                 $sql .= $db->quote_identifier($column) . ' ' . $op . ' ' . $value;
             }
             $last_condition = $condition;
         }
     }
     return $sql;
 }

 /**
  * Insere um autor no banco de dados
  * @return mixed O resultado da query
  */
 public function insert()
 {
     $db = new Database();
     $data = [];
     if (!empty($this->id_autor)) {
         $data['id_autor'] = (int) $this->id_autor;
     }
     if (!empty($this->nome)) {
         $data['nome'] = $db->quote($this->nome);
     }
     return $db->insert('autor', $data);
 }

 protected function _compile_set(Database $db, array $values)
 {
     $set = array();
     foreach ($values as $group) {
         list($column, $value) = $group;
         $column = $db->quote_column($column);
         if ((is_string($value) and array_key_exists($value, $this->_parameters)) === FALSE) {
             $value = $db->quote($value);
         }
         $set[$column] = $column . ' = ' . $value;
     }
     return implode(', ', $set);
 }

 /**
  * Replaces any parameter placeholders in a query with the value of that
  * parameter. Useful for debugging. Assumes anonymous parameters from
  * $params are are in the same order as specified in $query.
  *
  * @param string $query  The sql query with parameter placeholders
  * @param array  $params The array of substitution parameters
  *
  * @return string The interpolated query
  */
 private function interpolate($query, $params)
 {
     $keys = [];
     // build a regular expression for each parameter
     foreach ($params as $key => $value) {
         if (is_string($key)) {
             $keys[] = '/:' . preg_quote($key) . '/';
         } else {
             $keys[] = '/[?]/';
         }
         $params[$key] = $this->database->quote($value, \PDO::PARAM_STR);
     }
     return preg_replace($keys, $params, $query, 1);
 }

 public function compile(Database $db)
 {
     switch ($this->_drop_type) {
         case 'database':
             return 'DROP DATABASE ' . $db->quote($this->_object->name);
         case 'table':
             return 'DROP TABLE ' . $db->quote_table($this->_object->name);
         case 'column':
             return 'DROP COLUMN ' . $db->quote_identifier($this->_object->name);
         default:
             throw new Database_Exception('Invalid drop object');
     }
     return $query;
 }

 /**
  * Compile the SQL query and return it.
  *
  * @param   object  Database instance
  * @return  string
  */
 public function compile(Database $db)
 {
     // Start an update query
     $query = 'UPDATE ' . $db->quote_table($this->_table);
     $update = array();
     foreach ($this->_set as $set) {
         // Split the set
         list($column, $value) = $set;
         // Quote the column name
         $column = $db->quote_identifier($column);
         $update[$column] = $column . ' = ' . $db->quote($value);
     }
     // Add the columns to update
     $query .= ' SET ' . implode(', ', $update);
     if (!empty($this->_where)) {
         // Add selection conditions
         $query .= ' WHERE ' . Database_Query_Builder::compile_conditions($db, $this->_where);
     }
     return $query;
 }

 public function compile(Database $db)
 {
     // Lets identify the type
     switch (strtolower($this->_drop_type)) {
         // We're dropping an entire database!
         case 'database':
             return 'DROP DATABASE ' . $db->quote($this->_name);
             // Just a table to be dropped.
         // Just a table to be dropped.
         case 'table':
             return 'DROP TABLE ' . $db->quote_table($this->_name);
             // A column to be dropped.
         // A column to be dropped.
         case 'column':
         case 'constraint':
         case 'index':
             return 'DROP ' . strtoupper($this->_drop_type) . ' ' . $db->quote_identifier($this->_name);
             // Something we did not recognise.
         // Something we did not recognise.
         default:
             return 'DROP ' . strtoupper($this->_drop_type) . ' ' . $this->_name;
     }
 }

                         $db->query($query);
                     } else {
                         if (isset($_GET['insert'])) {
                             $query = "INSERT INTO " . $_GET['table'] . " (";
                             $i = 0;
                             foreach ($_POST as $vblname => $value) {
                                 $query .= $vblname . ",";
                             }
                             $query = substr($query, 0, sizeof($query) - 2);
                             $query .= ") VALUES (";
                             $i = 0;
                             foreach ($_POST as $vblname => $value) {
                                 if ($value == "") {
                                     $query .= "NULL,";
                                 } else {
                                     $query .= $db->quote($value) . ",";
                                 }
                             }
                             $query = substr($query, 0, sizeof($query) - 2);
                             $query .= ")";
                             $db->query($query);
                             $insertQuery = $query;
                         }
                     }
                 }
             }
         }
     }
 }
 echo "<div id='container'>";
 echo "<div id='leftNav'>";

 /**
  * Appends a WHERE statement to the {@link $query}.
  * The $column parameter holds a string that looks something like "table.datecolumn"
  *
  * The DTO parameter specified by $name will be compared against the column
  *
  * @param Database $db     The database
  * @param Query    $query  The Query
  * @param DTO      $dto    The DTO
  * @param string   $name   The name of the DTO parameter that holds the value
  * @param string   $column A string that will be used in the WHERE query
  *
  * @return void
  */
 public function buildEqualsFilter($db, $query, $dto, $name, $column = null)
 {
     if ($dto->getParameter($name) != null) {
         if (empty($column)) {
             $column = $name;
         }
         $value = $dto->getParameter($name);
         if (is_array($value)) {
             if (in_array('NULL', $value)) {
                 $query->WHERE("{$column} IS NULL OR {$column} IN (" . $db->joinQuote($value) . ")");
             } else {
                 $query->WHERE("{$column} IN (" . $db->joinQuote($value) . ")");
             }
         } else {
             if (is_null($value)) {
                 $query->WHERE("{$column} IS NULL");
             } else {
                 $query->WHERE("{$column} = {$db->quote($value)}");
             }
         }
     }
 }

 /**
  * database connection test.
  */
 public function test_database_connection()
 {
     $name = "test_database_connection";
     $db = new Database();
     test($db->getDatabaseObject());
     if ($db->tableExists($name)) {
         $db->dropTable($name);
     }
     // table exists
     test($db->tableExists($name) == FALSE);
     $db->createTable($name);
     test($db->tableExists($name));
     // quote
     // @Attention 반드시 아래의 quote 가 통과를 해야 한다.
     $ret_str = $db->quote("str");
     test($ret_str == "'str'", '', 'Quote failed...');
     $ret_str = $db->quote("st'r");
     test($ret_str == "'st''r'", '', 'Quote failed...');
     // table drop
     $db->dropTable($name);
     test($db->tableExists($name) == FALSE);
 }