php - Passing $_POST to Db Class Without any Processing -
i trying pass $_post global variable directly database through mysqli_real_escape_string without processing... here code working fine. what possible problem arising due type of coding? what security risks? is shortcut or there still more...??? class db{ ... more ... public function insert($args=array()){ if(!isset($args['table']) || !isset($args['values'])){ return false; } $table=$args['table']; $values=$this->process_insert($args['values']); $query="insert {$table} {$values}"; $result=$this->query2db($query); //method returns mysqli_query() if($result){ return true; }else{ return false; } } protected function process_insert($data=array()){ $values=""; $fields=""; $glue=", "; if(isset($data)){ foreach($data $key=> $value){ ...