万能写入sql语句,并且防注入

$_POST=array('title'=>23,'content'=>'kmm');

$keys= array_keys($_POST);

/**

* $filetarr数组用于规定只可以写入的字段

*/

$filetarr=array('title','content');

$filtre=true;

foreach ($keys as $value){

if(in_array($value, $filetarr,true)){

}else{

//var_dump($value);

$filtre=false;

break;

}

}

if($filtre){

$fields=implode(',', $keys);

$fieldszwh=':'.implode(',:', $keys);

$sql="insert into article({$fields}) values({$fieldszwh})";

$pdostatement= $pdo->prepare($sql);

$pdostatement->execute($_POST);

var_dump($pdostatement->errorInfo());

}else{

echo '非法字段';

}

$_POST=array('title'=>23,'content'=>'km');

$keys= array_keys($_POST);

/**

* $filetarr数组用于规定只可以写入的字段

*/

$filetarr=array('title','content');

$filtre=true;

$where='';

/**

*$wherearr数组用来根据字段指定查询条件,例如大于,等于,like

*/

$wherearr=array('title'=>'like','content'=>'>%');

foreach ($keys as $value){

if(in_array($value, $filetarr,true)){

if($wherearr[$value]==='between'){

if(count(explode(',', $_POST[$value]))===1){

break;

}

$where.='and '.$value.' between '.":{$value}left".' and '.":{$value}right ";

$_POST[$value]=explode(',', $_POST[$value]);

$_POST[$value.'left']=$_POST[$value][0];

$_POST[$value.'right']=$_POST[$value][1];

unset($_POST[$value]);

}else{

$where.='and '.$value.' '.$wherearr[$value].' '.":{$value} ";

}

}else{

//var_dump($value);

$filtre=false;

break;

}

}

/**

*

*如果用or连接条件语句,截取前面两个字符

*/

$where=substr($where,3);

if($filtre){

$fields=implode(',', $keys);

$fieldszwh=':'.implode(',:', $keys);

$sql="select  * from article where {$where}";

var_dump($sql);

$pdostatement= $pdo->prepare($sql);

$pdostatement->execute($_POST);

$re=     $pdostatement->fetchAll();

var_dump($pdostatement->errorInfo());

var_dump($_POST);

var_dump($re);

}else{

echo '非法字段';

}