My take on SQL is to abstract it whenever possible, as you always have to escape your values and the SQL syntax is generally easy to get wrong, without any static syntax control what-so-ever.
sqlinsert below takes $values as an associative array of column values.
sqlquery is just mysql_query with error reporting via e-mail, so you can directly replace it with mysql_query.
You can thank me later.
Cheers,
Anders
function esc($text)
{
return mysql_real_escape_string($text);
}
function sqlinsert($table, $values)
{
$len = sizeof($values);
if ($len > 0)
{
$query = "INSERT INTO $table ( ";
$first = true;
foreach ($values as $column => $value)
{
$query .=!$first ? ', ' : '';
$first = false;
$query .= "`$column`";
}
$query .= ' ) VALUES ( ';
$first = true;
foreach ($values as $column => $value)
{
$query .=!$first ? ', ' : '';
$first = false;
$query .= "'" . esc($value) . "'";
}
$query .= ' )';
sqlquery($query);
return mysql_insert_id();
}
return false;
}