does binding param strip out underscores? - php

Question

I used the following function:
function update_value($table, $field, $value, $type, $where1, $value1, $where2=NULL, $value2=NULL, $where3=NULL, $value3=NULL) {
$rows = array();
global $conn;
connect();
$value1 = "'" . $value1 . "'";
$sql = "UPDATE $table SET $field =? WHERE $where1 = $value1";
$bind1 = "'" . "$type" . "'";
if ($where2 != NULL) {
$value2 = "'" . $value2 . "'";
$sql .= " AND $where2 = $value2";
}
if ($where3 != NULL) {
$value3 = "'" . $value3 . "'";
$sql .= " AND $where3 = $value3";
}
$stmt = $conn->prepare($sql);
$stmt->bind_param($type, $value);
$stmt->execute();
$stmt->close();
$conn->close();
}
...to update the username field of a table (making sure it's a string before updating via the above function). I tried updating with a string followed by an underscore but when it showed up in the table the underscore had disappeared.
I'm new to binding parameters, is there certain things it strips out? If so I'd like to know exactly what so I can use preg_match to catch them before it updates and alert the users.

Answer 1

The way you manipulate with data is very dangerous.
But just to fix some potential issues keeping your logic you should surround all potential table and column names with backticks and prepare values with mysqli_real_escape_string():
$val1 = "'" . mysqli_real_escape_string($value1) . "'";
$sql = "UPDATE `$table` SET `$field` = ? WHERE `$where1` = $val1";
if (!empty($where2)) {
$value2 = "'" . mysqli_real_escape_string($value2) . "'";
$sql .= " AND `$where2` = $value2";
}
if (!empty($where3)) {
$value3 = "'" . mysqli_real_escape_string($value3) . "'";
$sql .= " AND `$where3` = $value3";
}