"proteger" les variables dans du SQL

$res = query( "update matable set un_champ = ?

               where autre_champ = ?

               and encore_un <> ?",

               array( $valeur1, $valeur2, $valeur3 ) );

function query( $requete, $params )

{

    // à définir : $sql_handle

                   

    if( count( $params ) > 0 )

    {

        $search = array();

        $replace = array();

        

        $count = 0;

        foreach( $params as $idx => $value )

        {

            if( $value === NULL )

                $value = 'NULL';

            elseif( is_string( $value ) )

                $value = '\''.mysql_real_escape_string( $value, $sql_handle ).'\'';

            elseif( is_bool( $value ) )

                $value = (int) $value;



            $token = '¤¤'.($count++).'¤¤';

            $requete = preg_replace( '#\\?#', $token, $requete, 1 );

            $search[] = $token;

            $replace[] = $value;

        }



        $requete = str_replace( $search, $replace, $requete );

    }

    

    if( ! $result = @ mysql_query( $requete, $sql_handle ) )

    {

        // traitement de l'erreur

        // [...]

    }

    

    return $result ;

}