Click here to Skip to main content
15,887,214 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi Everyone,

Any suggestion to improve the class below?
Note: it works fine but need some expert advise to make is free from sql injection.

What I have tried:

<pre><?php


class DB extends PDO {

    protected $db_name = "xxxxx";
    protected $db_user = "root";
    protected $db_pass = "";
    protected $db_host = "localhost";

    public function __construct() {
        try {
            parent::__construct("mysql:host={$this->db_host};dbname={$this->db_name}", $this->db_user, $this->db_pass);
        } catch (PDOException $e) {
            echo $e->getMessage();
        }
    }


	public function delete($table,$cond,$limit=1){
      $sql = "DELETE FROM $table WHERE $cond LIMIT $limit ";
      return $this->DBconnect->exec($sql);
    }
	
    
  }

 
  
?>
Posted
Updated 9-Jan-19 2:29am
v7

1 solution

I guess someone had already asked that: mysql - How can I prevent SQL injection in PHP? - Stack Overflow[^].
 
Share this answer
 
Comments
Member 14093672 9-Jan-19 9:13am    
How about improving the above class? please.
Member 14093672 9-Jan-19 9:18am    
How could we improve this ie., check the connection is active than re-use the connection otherwise create a new one. please kindly advise?

if(!isset($this->DBconnect)){

try{

}catch(PDOException $e){
echo 'Connection Fail..'.$e->getMessage();
}
}
}

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900