array_map() probably obvious mistake

[bleuh111]

The code below is part of a class to escape strings, but should also accept an array, using array_map() to do the job. Unfortunately, passing an array results in the original, unescaped array being returned - can't figure out why? If you uncomment the echo statement, it is outputting the correct escaped string for each element of the array, so the callback is definitely happening.

 

  public function escape_str($str)

  {

      if (is_array($str))

      {

        array_map(array('MYSQL_DB','escape_str'),$str);

      }

      else

      {

        if (get_magic_quotes_gpc()) {

            $str = stripslashes($str);

        }

        if (!is_numeric($str)) {

            $str = "'" . mysql_real_escape_string($str) . "'";

            //echo $str.'<br />';

        }

      }

      return $str;

  }

 

Example:

$xt = array("' OR ''=''",'"abcdefg"');

print_r($db->escape_str($xt));

 

Outputs original array, not escaped!

 

Can anyone help with this? Thanks.

[GingerRobot]

You're not assigning the return value of the array_map function to anything. If you take a look at the manual page (array_map) you'll see the function returns the array after having applied the supplied function to all the elements of the array.

 

This is something you have to keep an eye on with the array function; some do their job in-place, others create a copy.

[bleuh111]

You're not assigning the return value of the array_map function to anything. If you take a look at the manual page (array_map) you'll see the function returns the array after having applied the supplied function to all the elements of the array.

 

This is something you have to keep an eye on with the array function; some do their job in-place, others create a copy.

 

This is a Home Simpson "D'oh!" moment!

I knew it was something bloody obvious!

 

$str = array_map(.....) is of course the correct syntax.

 

I did know that...honest....just having a bad day due to stomach flu!