php防sql注入類別(php pdo防止sql注入的類別)

class Model{
protected $tableName="";//表名
protected $pOb ;//pdo類物件
function __construct(){
$pdo=new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME,DB_USERNAME,DB_PASSWORD);
$pdo ->exec("set names ".DB_CHARSET);
$this->pOb=$pdo;
}
/*
* 作用：增
* 參數：array $arr exp :array('欄位名稱'=>值,'欄位名稱'=>值,....)
* return:int|false
*/
function add($arr){
//拼sql語句
$kArr=array_keys($arr);
$kStr=join(",",$kArr);
$vArr=array_values($arr);
$pStr = '';
foreach ($vArr as $s=>$y){
$vname = "p".$s;
$pStr.=': '.$vname.',';
}
$pStr = substr($pStr,0,-1);
$sql = "insert into {$this- >tableName}($kStr) values($pStr)";
print_r($sql);
$pdoS = $this->pOb ->prepare($sql);
foreach ($vArr as $k=>$y){
$vname = "p".$k;
$$vname = $y;
var_dump($vname,$$vname) ;
$pdoS -> bindParam(":".$vname, $$vname,PDO::PARAM_STR);
}
$re = $pdoS -> execute( );
if($re){//新增成功
//回傳主鍵id值
return $this->pOb->lastInsertId();
}
//回傳值
return $re;
}
public function delete($arrWhere){
if(!empty($arrWhere)){
$strW = " where ";
foreach( $arrWhere as $kW=>$vW){
$kn = str_replace(":", "", $kW);
if(count($arrWhere)==1){
$strW .= $kn."=".$kW;
}else{
$strW .= $kn."=".$kW." and ";
}
}
 if(count($arrWhere)>1){
$strW .= " 1=1 ";
}
}
$sql = "delete from {$this->tableName}". $strW;
print_r($sql);
$pdoS = $this->pOb->prepare($sql);
foreach ($arrWhere as $kW=>$vW){
 $kn = str_replace(":", "", $kW);
$$kn = $vW;
if(is_int($vW)){
$pdoS->bindParam($kW, $$kn,PDO::PARAM_INT);
}else if(is_float($vW)){
$pdoS->bindParam($kW,$$kn,PDO::PARAM_INT);
} else{
$pdoS->bindParam($kW,$$kn,PDO::PARAM_STR);
}
}
$re=$pdoS->execute();
if
if ($re){
 return true;
}else {
return false;
}
}
function update($arrSet,$arrWhere){
//拼sql語句
$str = "";
$n=0;
foreach ($arrSet as $kS=>$vS){
$str .= " ,".$kS."=:p".$n ;
}
$str = substr($str, 1);
foreach($arrWhere as $kW=>$vW){
$kn=str_replace(":","",$kW);
if(count($arrWhere)==1){
$strW .= $kn."=".$kW;
}else{
$strW .= $kn."=".$kW." and ";
}
}
if(count($arrWhere)>1){
$strW .= " 1=1 ";
}
$sql="update {$this->tableName} set {$str} where ".$strW;
//print_r($sql);
$pdoS=$this->pOb->prepare($sql);
$x = 0;
foreach($ arrSet as $kS=>$vS){
$kS = ":p".$x ;
$$kS = $vS;
if(is_int($vS)){
$pdoS->bindParam($kS,$$kS,PDO::PARAM_INT);
}else if(is_float($vS)){
$ pdoS->bindParam($kS,$$kS,PDO::PARAM_INT);
}else{
$pdoS->bindParam($kS,$$kS,PDO::PARAM_STR);
}
}

foreach($arrWhere as $kW=>$vW){
$kn=str_replace(":","",$kW);
$$kn=$vW;//$p0 $p1 $p2
if(is_int($vW)){
$pdoS->bindParam($kW,$$kn,PDO::PARAM_INT) ;
}else if(is_float($vW)){
$pdoS->bindParam($kW,$$kn,PDO::PARAM_INT);
}else{
$pdoS-> bindParam($kW,$$kn,PDO::PARAM_STR);
}
}
$re=$pdoS->execute();
if($re){
 return true;
}else{
return false;
}
}
//查詢
function select($field ="*",$ArrayWhere="",$order="",$limit=""){
if(!empty($ArrayWhere)){
$strW = " where ";
 foreach($ArrayWhere as $kW=>$vW){
$kn=str_replace(":","",$kW);
if(count($ArrayWhere)==1){
 $strW .= $kn."=".$kW;
}else{
$strW .= $kn."=".$kW." and ";
}
}
if(count($ArrayWhere)>1){
$strW .= " 1=1 ";
}
}
if(!empty($ order)){
$order="order by ".$order; }
if(!empty($limit)){
$limit="limit ".$limit;
}
//select 欄位清單 from 表名 where 條件 order by 欄位 desc|asc limit start,length;
$sql="select {$field} 從 {$this->tableName} {$strW} {$order} {$limit}";
//print_r($sql);
$pdoS=$this->pOb->prepare($sql);
if(!empty($ArrayWhere)){
foreach($ArrayWhere as $kW=>$vW){
$kn=str_replace(":","",$kW);
$$kn=$vW;
if(is_int($vW)){
$pdoS->bindParam($kW,$$kn,PDO::PARAM_INT);
}else if(is_float($vW)){
$pdoS->bindParam($kW,$$kn,PDO::PARAM_INT);
}else{
$pdoS->bindParam($kW,$$kn,PDO::PARAM_STR);
}
}
}
$re=$pdoS->execute();
if($re){
$pdoS->setFetchMode(PDO::FETCH_ASSOC);
回傳$pdoS->fetchAll();
}else {
回傳 false;
}
}
}