query validation

[PureDrive]

Hi this is my first post. I am writing a new database class from scratch and I am not going to include query validation in the class (ex. check for query injections), because logically, this should be done in a different place. I also don't want to check for query validation directly in my code. I was wondering if you guys have any object oriented idea for query validation, or simply a useful technique. Thanks

[laserlight]

Instead of trying to validate queries, validate input. Under some circumstances (e.g., a block of user submitted text) one may not even bother validating and just escape the input.

[PureDrive]

Ah yea sorry, I meant validate input rather than validate queries.

[laserlight]

Okay, now that that is settled, the question to ask is: what do you want your database class to do?

Some database classes are thin wrappers for the underlying database API. PDO is an example of this. Other database classes (try to) abstract away the differences between database vendors. ADOdb is an example of this. Yet other database classes really are storage classes that form the storage layer in a script, and thus are specific to that script.

[liquorvicar]

If you use prepared statements (using PDO or MySQLi or similar), does this not automatically escape your parameters, leaving you to concentrate on validating your input data?