PHP - GetSQLValueString function

Question

I see a function GetSQLValueString and I don\'t know what is it dealing with, could someone give me some idea?
Thanks you

function GetSQLValueString($t         


        

Answer 1

This function return data type specific quoted string. This is used to avoid sql injection.

Answer 2

I guess your problem is related to the mysqli_ issue. You need to change all mysql_ to mysqli_ and add the connection to the database as first parameter. In my case the connection to the database is $conn_vote. Be aware that I added $conn as function's parameter :

 function GetSQLValueString($conn_vote, $theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
    {
      $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

      $theValue = function_exists("mysqli_real_escape_string") ? mysqli_real_escape_string($conn_vote, $theValue) : mysqli_escape_string($conn_vote, $theValue);`enter code here`

      switch ($theType) {
        case "text":
          $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
          break;    
        case "long":
        case "int":
          $theValue = ($theValue != "") ? intval($theValue) : "NULL";
          break;
        case "double":
          $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
          break;
        case "date":
          $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
          break;
        case "defined":
          $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
          break;
      }
      return $theValue;
    }
    } 

`

Answer 3

Your function escapes the string using MySQL's built-in string escaping function, then if it is a non-numeric value, surrounding it in single quotes. This function was written for inserting variable data into SQL queries.

$sql = "SELECT * FROM users WHERE username = " . GetSQLValueString($_GET['username'], 'text');
$result = mysql_query($sql);

Answer 4

From my understanding this function is probably to escape some data to pass it to MySQL. The function also handles null values and put some quotes if needed.

it should be used this way

GetSQLValueString("a value that I want to escape's", 'text');

see the SQL injection problem to understand why this function exists