i couldn't understand this class?

[phpsharma]

Hi,
This is a method in a class called userlib, The functionality of this method is to add users info into users_users. can any body explain the class?. Not entire class but at query
This will be called by this command

---

$userlib->add_user($REQUEST["name"],$REQUEST["pass"],$REQUEST["email"],'',$REQUEST['useradd'],$_REQUEST['phoneno']);

---

This is query

---

$query = "insert into
users_users(login, password, email, provpass,
registrationDate, hash, pass_due, created,address,phoneno)
values(?,?,?,?,?,?,?,?,?,?)";
how this ?????? marks really works

---

what is the secret behid this
$result = $this->query($query, array(
$user,
$pass,
$email,
$provpass,
(int) $now,
$hash,
(int) $new_pass_due,
(int) $now,
$useradd,
$phoneno
));

---

Entire method in a class

---

function add_user($user, $pass, $email, $provpass = '', $useradd, $phoneno) {
global $pass_due, $tikilib;

global $feature_clear_passwords;
// Generate a unique hash; this is also done below in set_user_fields()
$hash = md5($user . $pass . $email);

if ($feature_clear_passwords == 'n')
    $pass = '';

if ($this->user_exists($user))
    return false;

$now = date("U");
$new_pass_due = $now + (60 * 60 * 24 * $pass_due);
$query = "insert into
    `users_users`(`login`, `password`, `email`, `provpass`,
	    `registrationDate`, `hash`, `pass_due`, `created`,`address`,`phoneno`)
    values(?,?,?,?,?,?,?,?,?,?)";
$result = $this->query($query, array(
	    $user,
	    $pass,
	    $email,
	    $provpass,
	    (int) $now,
	    $hash,
	    (int) $new_pass_due,
	    (int) $now,
	    $useradd,
	    $phoneno
	    ));

$this->assign_user_to_group($user, 'Registered');

if( $tikilib->get_preference("eponymousGroups", 'n') == 'y' )
{
    // Create a group just for this user, for permissions
    // assignment.
    $this->add_group($user, "Personal group for $user.", '');

    $this->assign_user_to_group($user, $user);
}

return true;
echo "subbu ok";
}

bye
sharma

[swr]

The question marks are placeholders.

When $this->query is called, the second argument is an array. The first element of the array ends up where the first ? is, the second element ends up where the second ? is, and so forth.

The usual reason for using placeholders is to prevent SQL injection attacks. The code you posted also explicitly casts some variables to int, which also helps prevent SQL injection (non-numeric stuff will become a harmless 0).

Google for "sql injection" for more info on SQL injection attacks, and why you would want to code the way that guy did.

[phpsharma]

Hi thanks for your reply, I am new to classess concept. so iam reviewing other codes and learning. In that process i came across this proble,. Please suggest me some good websites regarding implementing OOPs in PHP. My problem is i can't read materials. Just i go through the previous examples and try to imlementing them.

Thanks for ur concern

bye..
sharma