function CustomQuery()
{
$arguments = func_get_args ();
if (sizeof ($arguments) > 0)
{
$query_string = $arguments[0];
for ($index = 1; $index < sizeof ($arguments); $index++)
$query_string = preg_replace ("/\?/", "'" . mysql_real_escape_string ($args[$index]) . "'", $query_string, 1);
}
else
{
return FALSE;
}
I have created a custom function to handle queries in my application. An example usage would be:
$this->CustomQuery('SELECT * FROM USERS WHERE Username = ? AND Points < ?', $username, $points);
This function currently uses legacy mysql functions, but switching to mysqli is simple by replacing occurrences of mysql with mysqli throughout the codebase.
Is the current method of using mysql_real_escape_string on each parameter safe enough against SQL Injection attacks? While it has worked without issues so far, should I consider switching to mysqli_real_escape_string for enhanced security?
Although I am aware of prepared statements in mysqli, personally I find using bindParam for every variable somewhat excessive.
What are your thoughts on this approach?