用于从MySQL数据库获取数据的通用PHP函数

Question

I'm creating a web application that relies heavily upon getting data from MySQL using PHP. In ~50 functions I have very similar code requesting single data values from MySQL:

function get_profile_picture($whatmember) {
    global $connection;
    $whatmember = mysql_prep($whatmember);
    $query = "SELECT picture_location FROM members WHERE member_id={$whatmember} LIMIT 1";
    $returnval = mysqli_query($connection,$query);
    if(!$returnval) {
        return "Query failed: " . mysqli_error($connection);
    }
    if(mysqli_num_rows($returnval) > 0 ) {
        $row = mysqli_fetch_assoc($returnval);
        return $row["picture_location"];
    }
    return false;
}

So my question is this: is there a generic AND safe way to make the function so that I can just input "SELECT what-value FROM what-database.what-table WHERE what-criteria=what-value" that allows for arrays of results as well as single values? I made an attempt with the following, but it obviously is a hack and slash method that only gets single values:

function get_single_value($database_name,$column_name,$table_name,$criteria,$criteria_value) {
    $database_name = mysql_prep($database_name);
    $column_name = mysql_prep($column_name);
    $table_name = mysql_prep($table_name);
    $criteria = mysql_prep($criteria);
    $criteria_value = mysql_prep($criteria_value);

    if(!empty($column_name) && !empty($table_name) && !empty($criteria) && !empty($database_name)) {
        global $connection;
        global $gamesconnection;
        global $locationconnection;

        if($database_name=="connection") {
            $database_connection = $connection;
        } else if ($database_name=="games") {
            $database_connection = $gamesconnection;
        } else if ($database_name=="locations") {
            $database_connection = $locationconnection;
        } else {
            die("Database connection doesn't exist for {$database_name}.");
        }
        $query = "SELECT {$column_name} FROM {$table_name} WHERE {$criteria}='{$criteria_value}' LIMIT 1";
        $result = mysqli_query($database_connection,$query);
        if(!$result) {
            die("Unable to get {$column_name} from {$table_name}. Error: " . mysqli_error($database_connection) . " Query: " . $query);
        }
        if(mysqli_num_rows($result)>0) {
            $row = mysqli_fetch_assoc($result);
            return $row[$column_name];
        }
    }
    return false;
}

And my get_profile_picture() function would then look more like this:

function get_profile_picture($whatmember) {
    return get_single_value("connection","picture_location","members","member_id",$whatmember);
}

I'm still pretty new to PHP and MySQL so any pointers to improve my code would be great as well. Thanks in advance!

Answer 1

Alright I wrote my own. It might not have all the security of PDO, but I don't have the learn another framework in order to use it.

function get_from_database($database_variable) {
    //PASS IN $database_variable WHICH IS AN OBJECT CONTAINING THE FOLLOWING POSSIBLE VALUES
    $database_name = $database_variable["database_name"]; //DATABASE NAME
    $column_name = $database_variable["column_name"]; //COLUMN(S) BEING REQUESTED
    $table_name = $database_variable["table_name"]; //TABLE BEING SEARCHED
    $criteria = $database_variable["criteria"]; // 'WHERE X'
    $limit = $database_variable["limit"]; //ANY LIMITS, IF REQUIRED
    $group_by = $database_variable["group_by"]; //ANY GROUPING, IF REQUIRED
    $order_by = $database_variable["order_by"]; //ANY SORT ORDERING, IF REQUIRED
    if(!empty($column_name) && !empty($table_name)&& !empty($database_name)) {
        global $connection;
        global $gamesconnection;
        global $locationconnection;
        global $olddataconnection;

        if($database_name=="connection") {
            $database_connection = $connection;
        } else if ($database_name=="games") {
            $database_connection = $gamesconnection;
        } else if ($database_name=="locations") {
            $database_connection = $locationconnection;
        } else if ($database_name=="olddata") {
            $database_connection = $olddataconnection;
        } else {
            error_log("
Database connection doesn't exist for {$database_name}." . get_backtrace_info());
            return false;
        }
        if(is_null($limit)) {
            //IF LIMIT NOT SUPPLIED, MAKE LIMIT 0, IE NO LIMIT
            $limit = 0;
        }
        if(is_int($limit)==false) {
            //NOT AN INTEGER
            error_log("
Error in limit provided: " . $limit . get_backtrace_info());
            return false;
        }
        $query = "  SELECT {$column_name} 
                    FROM {$table_name} " . (!empty($criteria) /*CHECK IF CRITERIA WAS REQUIRED*/ ? " 
                    WHERE {$criteria} " : "") . (!empty($group_by) /*CHECK IF GROUP BY WAS REQUIRED*/ ? " 
                    GROUP BY {$group_by} " : "") . (!empty($order_by) /*CHECK IF ORDER BY WAS REQUIRED*/ ? "
                    ORDER BY {$order_by} " : "") . ($limit!==0 /*CHECK IF LIMIT WAS REQUIRED*/ ? "
                    LIMIT {$limit} " : "");

        $result = mysqli_query($database_connection,$query);
        if(!$result) {
            error_log("
Unable to process query, got error: " . mysqli_error($database_connection) . "
Query: " . $query . get_backtrace_info());
            return false;
        }
        if(mysqli_num_rows($result)>0) {
            //RESULT SUPPLIED
            $row_array = array();
            while($row = mysqli_fetch_assoc($result)) {
                $row_array[] = $row;
            }
            mysqli_free_result($result);
            return $row_array;
        }
    }
    return false;
}

Function to trace function call back to source:

function get_backtrace_info(){
    //GET INFORMATION ON WHICH FUNCTION CAUSED ERROR
    $backtrace = debug_backtrace();
    $backtrace_string = "";
    for($i=0;$i<count($backtrace);$i++) {
        $backtrace_string .= '
';
        if($i==0) {
            $backtrace_string .= 'Called by ';
        } else {
            $backtrace_string .= 'Which was called by ';
        }
        $backtrace_string .= "{$backtrace[$i]['function']} on line {$backtrace[$i]['line']}";
    }
    return backtrace_string;
}

Now I can request data from MySQL as follows: Single value requested:

function get_profile_picture($whatmember) {
    $linked_member_code = get_linked_member_code($whatmember);
    return get_from_database([  "database_name" => "connection",
                                "column_name"   => "picture_location",
                                "table_name"    => "members",
                                "criteria"      => "linked_member_code='{$linked_member_code}' AND team_id=0",
                                "limit"         => 1
                            ])[0]["picture_location"];
}

2 values requested:

function get_city_and_region_by_id($whatid) {
    $row = get_from_database([  "database_name" => "locations",
                                "column_name"   => "city, region",
                                "table_name"    => "cities",
                                "criteria"      => "row_id={$whatid}",
                                "limit"         => 1
                            ]);
    return $row[0]["city"] . ", " . $row[0]["region"];
}

Unknown number of rows:

function get_linked_teams($linkedmembercode) {
    return get_from_database([  "database_name" => "connection",
                                "column_name"   => "team_id",
                                "table_name"    => "members",
                                "criteria"      => "linked_member_code='{$linkedmembercode}' AND team_id!=0"
                            ]);
}