Next version :) My version checks whether value is bool, null, string or numeric and if one of the values is not function returns false if not. null values are inserted as NULL, bool as true or false and strings are add-shlashed before adding to query string. Note, that this function is not safe. SQL injection is possible with column names if you use $_POST or something similar as a $array.
<?php
function db_build_insert($table, $array) {
if (count($array)===0) return false;
$columns = array_keys($array);
$values = array_values($array);
unset($array);
for ($i = 0, $c = count($values); $i$c; ++$i) {
if (is_bool($values[$i])) {
$values[$i] = $values[$i]?'true':'false';
} elseif (is_null($values[$i])) {
$values[$i] = 'NULL';
} elseif (is_string($values[$i])) {
$values[$i] = "'" . addslashes($values[$i]) . "'";
} elseif (!is_numeric($values[$i])) {
return false;
}
}
return "INSERT INTO $table ($column_quote" . implode(', ', $columns) .
") VALUES (" . implode(', ', $values) . ")";
}
?>
