Automatic mysql injection protection

[chantown]

Is there a way to automatically do this?  I don't want to apply  mysql_real_escape_string to every query

[darkfreaks]

nope

[cooldude832]

Yes there is, but you have to build it.  When you run a query rewrite it so that you have your own function query that applies injection protection

so instead of

mysql_query("Query String");

do

query("Query String")

 

and query is a custom function that applies injection protection in it to the string and so forth. 

[corbin]

To extend on cooldudes's post:

 

function CustomQuery() {
     $args = func_get_args();
     $query = array_shift($args);
     foreach($args as $k => $v) {
          $args[$k] = mysql_real_escape_string($v);
     }
     return vsprintf($query, $args);
}

 

It's been a while since I've used func_get_args, so that syntax might be on crack, but hopefully it shows the general idea....