Question

So I have an area where people can write their own query against my database, but I want to limit the returned results (much like PhpMyAdmin).

So I need to check $_POST['query'] to see if has a limit statement, if it does, make sure it’s under 30, say. If there is no limit, I need to add it.

How would I do this?

Answer 1

You can use preg_* functions to check the query and inject your preferred limit.

EDIT: I totally ignored possible uses of the LIMIT keyword. Here’s the edited version.

$query = 'SELECT * FROM aa LIMIT 100,20';
$limit = 20; // predefined max limit

// possibilities:
// LIMIT N[,N]
// LIMIT N OFFSET N

preg_match('~(?<=\blimit\s)\s*(?<limit>\d+)\s*(,\s*\d+|\soffset\s+\d+)?\s*$~i',$query,$limitStr);
if (isset($limitStr['limit'])) {
    $maxLimit = min((int)$limitStr['limit'],$limit);
    // user might have already limited it so this is
    // just to make sure it does not exceed your max.
    $query = preg_replace('~(?<=\blimit\s)\s*\d+\s*(,\s*\d+|\soffset\s+\d+)?\s*$~i',$maxLimit.'$1',$query);
} else $query .= " LIMIT $limit";

echo $query;

will output SELECT * FROM aa LIMIT 20,20