爲什麼PHP的PDO分機不能自動轉義輸入？

Question

爲了不必在單獨的語句中綁定每個值，爲什麼不能將PHP PDO的某些配置設置爲只是轉義所有輸入？

Answer 1

如果你單獨地約束所有東西，你就是在艱難地做着事情。別。

$dbh = PDO->new(...); 
$sth = $dbh->prepare("SELECT foo FROM bar WHERE baz = ?"); 
$sth->execute(array("this doesn't need to be escaped!")); 
... 

你可以讓這甚至用包裝材料的功能更容易：

function dbQuery($sql /* ... */) { 
    global $dbh; 
    $args = func_get_args(); 
    array_shift($args); 
    $sth = $dbh->prepare($sql); 
    $sth->execute($args); 
    return $sth; 
} 

$sth = dbQuery("SELECT foo FROM bar WHERE baz = ? AND qux != ?", "blah", "blah blah"); 
...