Write Forums

array_map() probably obvious mistake

Posted on 16th Feb 2014 07:03 pm by admin

The code below is part of a class to escape strings, but should also accept an array, using array_map() to do the job. Unfortunately, passing an array results in the original, unescaped array being returned - can't figure out why? If you uncomment the echo statement, it is outputting the correct escaped string for each element of the array, so the callback is definitely happening.

public function escape_str($str)
{
if (is_array($str))
{
array_map(array('MYSQL_DB','escape_str'),$str);
}
else
{
if (get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
if (!is_numeric($str)) {
$str = "'" . mysql_real_escape_string($str) . "'";
//echo $str.'<br />';
}
}
return $str;
}

Example:
$xt = array("' OR ''=''",'"abcdefg"');
print_r($db->escape_str($xt));

Outputs original array, not escaped!

Can anyone help with this? Thanks.

No comments posted yet

204 21 Tweet