ThingEngineer / PHP-MySQLi-Database-Class

Wrapper for a PHP MySQL class, which utilizes MySQLi and prepared statements.
Other
3.3k stars 1.34k forks source link

Enforcing parameter data type #187

Open FoxxMD opened 9 years ago

FoxxMD commented 9 years ago

When using rawQuery you can pass parameters as a separate argument, this is awesome BUT the type for each parameter(variable) is automatically determined using _determineType.

Before I go and hack something up myself, is there any current way to enforce the type expected for each parameter instead of automatically determining it? I would like to be able to validate parameters are the correct data type before executing a query.

I could just do this beforehand in my app but this functionality seems like it would be extremely useful for your library. Thanks!

avbdr commented 9 years ago

Writing such a feature would require to write 'one more data validation library'. I believe the best way is to sanitize your data before going into mysql as you wrote.

FoxxMD commented 9 years ago

I understand your point but I think I need to clarify what I mean by validate data type.

Taken from the php manual

$stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");
$stmt->bind_param('sssd', $code, $language, $official, $percent);

The types of data mysql expects for this statement are determined by the letters in the first argument passed. i is integer, d is double, and s is string. In the statement above sssd so string, string, string, double.

In the library _determineType already figures out what type of data is being passed in and builds up that string of types before calling bind_param. What I'm asking for is a way to pass sssd to rawQuery and then performing a simple equality check to see if the expected types (that I passed) match the string built by _determineType.

With a relatively simple check you can get data type enforcement in sql for your queries.

MikeLund commented 8 years ago

Any update or suggested use for this @avbdr? Most recent comment from last year seems really useful, and IMO is within the scope of this library... :)

ThingEngineer commented 5 months ago

Welcoming PR's for this.