Question

There is nothing wrong with my code, but I just cant help but wonder, should I wrap the $key with mysql_real_escape_string? This is just part of my Database function which is mainly used to pull data out of the database with table name and $where as arguments to the function. $where is to be an associative array with keys being column name, and values being the data.

This is what processes the $where array. Before this I have $sql = ‘select * from ‘ . $table;

if(!empty($where)){
        $where_count = count($where);

        $sql .= ' WHERE ';

        foreach($where as $key => $value){

            $split_key = explode(' ', $key);

            if(count($split_key) > 1){
                $sql .= $key[0] . ' ' . $key[1] . ' "' . mysql_real_escape_string($value) . '" ';
            } else {
                $sql .= $key . ' = "' . mysql_real_escape_string($value) . '" ';
            }
        }
    }

Answer 1

Filter ANY INPUT from the user that is going to be placed in your query. No doubt!
So if the keys are supplied by the user, YES and if they are generated in a safe manner, NO.

Take a look at SQL Injection to understand why filtering must be done.