I suggest that in this case you use https://www.php.net/manual/en/mysqli.quickstart.prepared-statements.php , present both in https://www.php.net/manual/pt_BR/book.pdo.php as in the OO interface of MySQLi, to avoid the famous SQL injections, which may indicate the vulnerability of your system, we can say so.Anyway, here I present a solution using the method you ask for, and another using the "safer" method.Using the functions mysqli_*public function cadastrarProdutos(string $tabela, array $campos, array $valores) {
$query = "INSERT INTO $tabela";
$query .= ' (' . implode(', ', $campos) . ') ';
$query .= 'VALUES (\n';
//Aqui adiciona aspas para todos os valores e escapa as que já vieram no valor. Ou seja,
// se o texto veio como 'Olá, 'mundo'!', transformará em
// 'Olá \'mundo\'!'
$valores = array_map(function($item) { return "'".addslashes($item)."'"; }, $valores);
$query .= implode(', ', $valores);
$query .= '\n);';
mysqli_query($this->conexao, $query);
//...
}
Using prepared statements with PDOHaving obviously done all PDO settings, the method could stay this way:public function cadastrarProdutos(string $tabela, array $campos, array $valores) {
$statement = $this->pdoConn->prepare('INSERT INTO ' . $tabela . ' (' . implode(', ', $campos) . ') VALUES (' . implode(', ', str_split( str_repeat('?', count($campos) ) ) ) . ');');
for ($i=0;$i<count($campos);$i++) {
$statement->bindValue($i+1, array_values($valores)[$i]);
}
$statement->execute();
}
Here I use for to be able to take each value and its position, since, in logic, the sequence of the elements in array of the values must be the same as the array of the fields (as well as the size of both must be the same), thus using the parameter bindValue to replace the value in the position equivalent to her field. That is, the SQL command at first would look like this:INSERT INTO produtos (Nome, Descricao, Valor, ValorDesconto) VALUES (?, ?, ?, ?);
And after all the replacements were made, it would be more or less so:INSERT INTO produtos (Nome, Descricao, Valor, ValorDesconto) VALUES ('<nome>', '<desc>', '<valor>'|<valor>, '<valor_desconto>'|<valor_desconto>);
OBS. : the notations '<valor>'|<valor> and '<valor_desconto>'|<valor_desconto> indicate that the value to be entered may be a text or a numerical value.And in both ways, you could create an "algorithm" to know the type of value and thus pass the "correct" form to the SQL command, differentiating those that are texts and those that are numbers, either through the manual form (the first solution), or by the prepared statements, using the method bindValue, which even has the parameter https://www.php.net/manual/pt_BR/pdostatement.bindparam.php , which by default accepts everyone as one string.Using prepared statements with mysqli (oriented to objects)Additionally, you can also use the prepared statements with MySQLi object-oriented "interface", which you can see better in https://www.php.net/manual/pt_BR/book.mysqli.php how to use, and do similarly to PDO:public function cadastrarProdutos(string $tabela, array $campos, array $valores) {
$statement = $this->mysqli->prepare('INSERT INTO ' . $tabela . ' (' . implode(', ', $campos) . ') VALUES (' . implode(', ', str_split( str_repeat('?', count($campos) ) ) ) . ');');
$statement->bind_param("ssss", ...array_values($valores));
$statement->execute();
//$statement->close();
}
The question of the meaning of those "ssss", you can also see on https://www.php.net/manual/pt_BR/mysqli-stmt.bind-param.php , but basically, I'm informing that all the values that are to be placed in command are strings. And after, I use spread operator (spreading operator, in free translation) to pass the values of array as parameters, but there may be other (best) ways to do. And here comes once again the possibility of you changing the values to the correct (data) types, according to your needs.ConclusionFinally, to use the method cadastrarProdutos, whatever the chosen form of the above would be:require "...";
$tabela = "produtos";
$campos = array('Nome', 'Descricao', 'Valor', 'ValorDesconto');
$valores = array_filter($_POST);
$metodos->cadastrarProdutos($tabela, $campos, $valores);
I hope I helped!
