PHP Code:
<?php
class Database {
protected $sql;
protected $tableArray;
protected $result;
function __construct() {
global $credentialsArray;
$mysqliCredentialsArray = $credentialsArray;
$this->sql = new MySQLi($mysqliCredentialsArray['Host'], $mysqliCredentialsArray['User'], $mysqliCredentialsArray['Password'], $mysqliCredentialsArray['Database']);
}
private function ObjectValidation($object){
foreach($object as $key => $value){
$secure = self::Secure($value);
$object[$key] = $secure;
}
return $object;
}
private function QueryConstruction($object, $statement){
$query = null;
switch($statement){
case 'cols':
foreach($object as $key => $value){
$query .= $value . ', ';
}
$query = substr($query, 0, strlen($query) -2);
break;
case 'where':
foreach($object as $key => $value){
if(gettype($value != 'integer')){$value = '\'' . $value . '\''; }else{$value = $value;}
$query .= $key . ' = ' . $value . ', ';
}
$query = substr($query, 0, strlen($query) -2);
$query = ' WHERE ' . $query;
break;
case 'update':
foreach($object as $key => $value){
if(gettype($value != 'integer')){$value = '\'' . $value . '\''; }else{$value = $value;}
$query .= $key . ' = ' . $value . ', ';
}
$query = substr($query, 0, strlen($query) -2);
break;
case 'cols2':
foreach($object as $key => $value){
$query .= $key . ', ';
}
$query = substr($query, 0, strlen($query) -2);
break;
case 'values':
foreach($object as $key => $value){
if(gettype($value != 'integer')){
$query .= '\'' . $value . '\', ';
}else {
$query .= $value . ', ';
}
}
$query = substr($query, 0, strlen($query) -2);
break;
}
return $query;
}
protected function Select($object, $table, $where, $extension = null){
$queryRows = self::QueryConstruction(self::ObjectValidation($object), 'cols');
if($where){$whereRows = self::QueryConstruction(self::ObjectValidation($where), 'where');}else{$whereRows = null;}
$this->result = $this->sql->query('SELECT ' . $queryRows . ' FROM ' . $table . $whereRows . $extension);
if($this->sql -> errno > 0){echo $this->sql->errno,': ',$this->sql->error;}
$store = array(
'Rows' => $this->result->num_rows,
'Result' => $this->result->fetch_all(MYSQLI_ASSOC),
);
$this->result->close();
return $store;
}
protected function Insert($object, $table){
$queryRows = self::QueryConstruction(self::ObjectValidation($object), 'cols2');
$queryValues = self::QueryConstruction(self::ObjectValidation($object), 'values');
$this->sql->query('INSERT INTO ' . $table . ' (' . $queryRows . ') VALUES (' . $queryValues . ')');
if($this->sql -> errno > 0){echo $this->sql->errno,': ',$this->sql->error;}
}
protected function Update($object, $table, $where){
$queryConstruct = self::QueryConstruction(self::ObjectValidation($object), 'update');
$whereRows = self::QueryConstruction(self::ObjectValidation($where), 'where');
$this->sql->query('UPDATE ' . $table . ' SET ' . $queryConstruct . $whereRows . '');
if($this->sql -> errno > 0){echo $this->sql->errno,': ',$this->sql->error;}
}
protected function Delete($table, $where){
$whereRows = self::QueryConstruction(self::ObjectValidation($where), 'where');
$this->sql->query('DELETE FROM ' . $table . $whereRows);
if($this->sql -> errno > 0){echo $this->sql->errno,': ',$this->sql->error;}
}
/******************************************************************************************************************************************************************\
* Escape Functions
\******************************************************************************************************************************************************************/
private static $valuePattern = '[a-zA-Z0-9`´\'.-~#!?+=\(\)",]+';
private static $replaceHTML = FALSE;
protected static function Secure( $qry, $html = FALSE )
{
$query = $qry;
self::$replaceHTML = $html;
if(strpos(strtolower($qry),'insert into') !== FALSE && strpos(strtolower($qry),'values') !== FALSE) {
preg_match_all('/VALUES \(('.self::$valuePattern.')\)/',$query, $params);
$params = explode(',',$params[1][0]);
$query = self::ParseParams($query,$params);
} else {
preg_match_all('/('.self::$valuePattern.')([\s]){0,}=([\s]){0,}('.self::$valuePattern.')/',$query, $params);
$query = self::ParseParams($query, $params[4]);
}
return $query;
}
private static function ParseParams( $query, $params )
{
$counter = 0;
foreach($params as $param => $value) {
$query = str_replace($value,"[$counter]",$query);
$counter++;
}
if(!empty($params[0])) {
foreach($params as $param => $value) {
$params[$param] = self::ParseParam($value);
}
}
$counter = 0;
foreach($params as $param => $value) {
$query = str_replace("[$counter]", $value,$query);
$counter++;
}
return $query;
}
private static function ParseParam( $param )
{
$count = substr_count($param,'\'');
$param = str_replace(array('/','\\','\'','"','`','´'),'',$param);
if($count != 0) {
$param = "'$param'";
}
if(self::$replaceHTML) {
$param = htmlspecialchars($param);
$param = htmlentities($param);
$param = strip_tags($param);
}
return $param;
}
}
