How to use PHP7's $mysqli->real_escape_string with an array

Question

Before PHP7, I would combine implode and array_map to go through each of the values with mysql_real_escape_string to prepare them for a statement to avoid sql injection. e.g:

$values = implode("', '", array_map('mysql_real_escape_string', $sqlArray));

mysql_real_escape_string has been replaced now by mysqli::real_escape_string. How would the above code be done with the new methods just as easily using the mysqli class in an array_map?

AbraCadaver · Accepted Answer · 2016-03-07 18:49:25Z

7

You might be better off using prepared statements, but to the question, pass an array of object and method. This should work for anything that takes a callback:

$result = array_map(array($mysqli, 'real_escape_string'), $sqlArray);

Assuming you have a $mysqli object that you're working with from the mysqli class.

edited Mar 7, 2016 at 18:49

answered Mar 7, 2016 at 18:41

AbraCadaver

79.2k7 gold badges75 silver badges91 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

RiggsFolly Over a year ago

Ok so now : What is $mysqli

willdanceforfun Over a year ago

Thanks, yeah I already have a $mysqli object. Many thanks Abra

RiggsFolly Over a year ago

Yea, I get that, but others may not. If you want your answer to be usful to others less intuitive than us, it would be useful to make that obvious in your answer

Collectives™ on Stack Overflow

How to use PHP7's $mysqli->real_escape_string with an array

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related