# Are these MySQL Abstraction Classes safe from SQL Injection? Can they be made safe?

I was looking at this website:

In the first one they have methods such as:

/**
* Perform a SELECT statement
*/
public function select($table,$where = '', $fields = '*',$order = '', $limit = null,$offset = null)
{
$query = 'SELECT ' .$fields . ' FROM ' . $table . (($where) ? ' WHERE ' . $where : '') . (($limit) ? ' LIMIT ' . $limit : '') . (($offset && $limit) ? ' OFFSET ' .$offset : '')
. (($order) ? ' ORDER BY ' .$order : '');
$this->query($query);
return $this->countRows(); } /** * Perform an INSERT statement */ public function insert($table, array $data) {$fields = implode(',', array_keys($data));$values = implode(',', array_map(array($this, 'quoteValue'), array_values($data)));
$query = 'INSERT INTO ' .$table . '(' . $fields . ')' . ' VALUES (' .$values . ')';
$this->query($query);
return $this->getInsertId(); }  then in the second page: /** * Fetch all users */ public function fetchAll() { // try to fetch users data from the cache system if ($users = $this->_cache->get('all')) { return$users;
}
// otherwise fecth users data from the database
$this->_adapter->select('users');$users = array();
while ($user =$this->_adapter->fetch()) {
$users[] =$user;
}
if (count($users) !== 0) {$this->_cache->set('all', $users); } return$users;
}

/**
* Insert new user data (the cache is cleared also)
*/
public function insert(array $data) { if ($insertId = $this->_adapter->insert('users',$data)) {
$this->_cache->clear(); return$insertId;
}
return false;
}

/**
* Delete the table row corresponding to the specified user (the cache is cleared also)
*/
public function delete($id) { if ($affectedRow = $this->_adapter->delete('users', "id =$id")) {
$this->_cache->clear(); return$affectedRow;
}
return false;
}


Is this a bad way of doing things? Is this opening me up to sql injection just like anything else where I construct the sql on the fly would? I want to build my models "right." Does that mean I need to have all stored procedures or prepared statements?

## migrated from stackoverflow.comAug 15 '12 at 13:27

This question came from our site for professional and enthusiast programmers.

• possible duplicate of Best way to prevent SQL Injection in PHP – vascowhite Aug 14 '12 at 20:23
• That's not a duplicate. I'll edit the title of this one to clarify. – Robert Harvey Aug 14 '12 at 20:24
• I can't see where your parameters are coming from, but theoretically as long as you are escaping them properly you should be ok. – Wug Aug 14 '12 at 20:25
• Don't do it this way, better to use PDO and parameterise your queries. There is a good tutorial here wiki.hashphp.org/PDO_Tutorial_for_MySQL_Developers. Also take a look at the information in the link in my previous comment. – vascowhite Aug 14 '12 at 20:26
• @RobertHarvey You may be right, but there's still some good information there for the OP. In fact, I think the accepted answer there could answer this question. Don't you? – vascowhite Aug 14 '12 at 20:27