sql - Atomic string replacement in PHP -

in our web application, have class emulates prepared statements correct escaping of sql parameters.

now, better use pdo, app old , refactoring quite long, time being wanted fix bug found.

consider piece of code uses our classes:

$s = q()->statement("select * dual 1 = :a , 2 = :b , 3 = :c"); $s->bindvalue('c', ':b'); $s->bindvalue('b', ':a'); $s->bindvalue('a', ':c'); var_dump($s->prepared); 

the first line creates statement, values bound, dump prepared statement.

the result of following:

select * dual 1 = ':c' , 2 = '':c'' , 3 = ''':c''' 

and happens because parameters substituted 1 @ time last first.

i tried doing replacement in single function call, using str_replace() array parameters, no avail.

so know if there way make operation somehow "atomic" if placeholder value valid placeholder not replaced.

edit:

here method of class replacement:

protected function prepare() {     if (!$this->db) {         trigger_error (__method__ . ': no connection available quote value', e_user_warning);         return false;     }      $this->prepared = str_replace(         array_map(array($this, 'getplaceholdername'), array_keys($this->params)),         array_map(array($this->db, 'quote'), array_values($this->params)),         $this->original     );      return true; } 

you want single call old strtr() whith array signature:

string strtr ( string $str , array $replace_pairs )

of course, plain string replacement hack , can never replace proper sql parser, guess know that.