I appreciate the ability to build queries in code, you code i...

I appreciate the ability to build queries in code, you code is very usefull, but lacking. This code is currently unsuitable for exposure to an internet facing server. Even though you excape your string, I could still give your the variable like... $safe_escaped = '1 UNION SELECT password FROM users. Or use crazy combinations of concat, char, hex, and undex to manually write out my command without your escaped slashes.

Hi there, thank you for your feedback.

I am not sure what you mean when you say that I am escaping the string?

Place holders with PDO are been used to escape values.

If you are feeding a custom stetement to the run method, well that is up to the programmer to secure the query then.

Make sure that you have read the manual also.

Please explain more in details what you mean, so that I can actually address the issue and improve the interface, thank you.

Your right, I missed the line: $this->_query->bindValue( $pos , $value , $type );
and got thrown off by the line: $query = 'INSERT INTO ' . $this->_table . ' (' . $fields . ') VALUES (' . $values . ')';

This be because i belive the variable $values contained the values, but rather it contains to bound variable name ie.. (:1, :2, :3).

I will re-rate this code. For I believe it to be secure.

Author provides an excelent PDO solution. I plan to give this code a try.