too long

Question

Is it possible to escape a whole query instead of each searched field. For example I know I can do it like this:

$name="O'Connor";
$email="mark.O'[e-mail]";

$name=mysql_real_escape_string($name);
$email=mysql_real_escape_string($email);

$query =("SELECT * FROM TABLE1 WHERE Name = '$name' OR Email = '$email' ");

// code to run query here 

What I am looking for is a way to build my query string like this :

$query=("SELECT * FROM TABLE1 WHERE Name = '$name' OR Email = '$email' ");
$query=mysql_real_escape_string($query); // Can I escape the whole Query ??

// code to run query here 

My reason for asking this Is I have a complex query which is using at around 15 variables from a form and I want to clean them all at once instead of using loads of mysql_real_escape($vairableName)...

Is this possible and can anyone exlplain how I can acheive this

Thanks in advance

Answer 1

As others have pointed out, using prepared statements is the best way to go. But in case you still want to proceed ahead, you can do something like this:

foreach($_POST as $key=>$value)
{
   // this will take care of escaping all form elements
   $$key = mysql_real_escape_string($value);
}

So if your form contains 3 elements whose names are abc, def, and ghi, the above code will create variables named as $abc, $def, and $ghi respectively.

Then you can use them in query as before:

$query = "SELECT * FROM TABLE1 WHERE Name = '$abc' OR Email = '$def'";