Open FoxxMD opened 9 years ago
Writing such a feature would require to write 'one more data validation library'. I believe the best way is to sanitize your data before going into mysql as you wrote.
I understand your point but I think I need to clarify what I mean by validate data type.
Taken from the php manual
$stmt = $mysqli->prepare("INSERT INTO CountryLanguage VALUES (?, ?, ?, ?)");
$stmt->bind_param('sssd', $code, $language, $official, $percent);
The types of data mysql expects for this statement are determined by the letters in the first argument passed. i
is integer
, d
is double, and s
is string. In the statement above sssd
so string, string, string, double
.
In the library _determineType
already figures out what type of data is being passed in and builds up that string of types before calling bind_param
. What I'm asking for is a way to pass sssd
to rawQuery
and then performing a simple equality check to see if the expected types (that I passed) match the string built by _determineType
.
With a relatively simple check you can get data type enforcement in sql for your queries.
Any update or suggested use for this @avbdr? Most recent comment from last year seems really useful, and IMO is within the scope of this library... :)
Welcoming PR's for this.
When using
rawQuery
you can pass parameters as a separate argument, this is awesome BUT the type for each parameter(variable) is automatically determined using_determineType
.Before I go and hack something up myself, is there any current way to enforce the type expected for each parameter instead of automatically determining it? I would like to be able to validate parameters are the correct data type before executing a query.
I could just do this beforehand in my app but this functionality seems like it would be extremely useful for your library. Thanks!