Question

When inserting a row in mysql database, string values need to be enclosed in quotes where integer don’t need to.

Is there any class or library that takes care of this automatically so that I can just pass to a 3rd-party function an array of fieldnames and values and don’t have to worry about putting string values in quotes?

Thanks,

Answer 1

You need to worry about more than just quoting; you need to worry about SQL injection.

For new code, use PDO instead of the mysql_ or mysqli_ functions. Within PDO, use prepared statements (the PDOStatement object).

With prepared statements, you never have to enclose things in quotes and it stops SQL injections.