php防sql注入数据model类

php 
class model{ 
protected $tablename="";//表名称 
protected $pob;//pdo类对象 
function __construct(){ 
$pdo=new pdo("mysql:host=".db_host.";dbname=".db_name,db_username,db_password); 
$pdo->exec("set names ".db_charset); 
$this->pob=$pdo; 
} 
/* 
* 作用：增 
* 参数：array $arr exp:array('字段名'=>值,'字段名'=>值,....) 
* return:int|false 
*/ 
function add($arr){
//拼sql语句 
$karr=array_keys($arr); 
$kstr=join(",",$karr); 
$varr=array_values($arr); 

$pstr = ''; 
foreach ($varr as $s=>$y){ 
$vname = "p".$s; 
$pstr.=':'.$vname.','; 
} 
$pstr = substr($pstr,0,-1); 

$sql = "insert into {$this->tablename}($kstr) values($pstr)"; 

print_r($sql); 
$pdos = $this->pob ->prepare($sql); 
foreach ($varr as $k=>$y){ 
$vname = "p".$k; 
$$vname = $y; 
var_dump($vname,$$vname); 
$pdos -> bindparam(":".$vname, $$vname,pdo::param_str); 

} 
$re = $pdos -> execute(); 
if($re){//添加成功 
//返回主键id值 
return $this->pob->lastinsertid(); 
} 
//返回值 
return $re;
} 
public function delete($arrwhere){ 
if(!empty($arrwhere)){ 
$strw = " where "; 
foreach($arrwhere as $kw=>$vw){ 
$kn = str_replace(":", "", $kw); 
if(count($arrwhere)==1){ 
$strw .= $kn."=".$kw; 
}else{ 
$strw .= $kn."=".$kw." and "; 
}
} 
if(count($arrwhere)>1){ 
$strw .= " 1=1 "; 
}
} 
$sql = "delete from {$this->tablename}".$strw; 
print_r($sql); 
$pdos = $this->pob->prepare($sql); 
foreach ($arrwhere as $kw=>$vw){ 
$kn = str_replace(":", "", $kw); 
$$kn = $vw; 
if(is_int($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else if(is_float($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else{ 
$pdos->bindparam($kw,$$kn,pdo::param_str); 
}
} 
$re=$pdos->execute(); 
if($re){ 
    return true; 
}else { 
return false; 
} 

} 
function update($arrset,$arrwhere){ 
//拼sql语句
$str = ""; 
$n=0; 
foreach ($arrset as $ks=>$vs){ 

$str .= ",".$ks."=:p".$n++; 
} 
$str = substr($str, 1);
foreach($arrwhere as $kw=>$vw){ 
$kn=str_replace(":","",$kw);
if(count($arrwhere)==1){ 
$strw .= $kn."=".$kw; 
}else{ 
$strw .= $kn."=".$kw." and "; 
}
}
if(count($arrwhere)>1){ 
$strw .= " 1=1 "; 
}

$sql="update {$this->tablename} set {$str} where ".$strw; 
//print_r($sql); 

$pdos=$this->pob->prepare($sql); 
$x = 0; 
foreach($arrset as $ks=>$vs){ 

$ks = ":p".$x++; 
$$ks = $vs; 

if(is_int($vs)){ 
$pdos->bindparam($ks,$$ks,pdo::param_int); 
}else if(is_float($vs)){ 
$pdos->bindparam($ks,$$ks,pdo::param_int); 
}else{ 
$pdos->bindparam($ks,$$ks,pdo::param_str); 
} 
} 


foreach($arrwhere as $kw=>$vw){ 
$kn=str_replace(":","",$kw); 
$$kn=$vw;//$p0  $p1 $p2 
if(is_int($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else if(is_float($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else{ 
$pdos->bindparam($kw,$$kn,pdo::param_str); 
} 
} 
$re=$pdos->execute(); 
if($re){ 
    return true; 

}else{ 
return false; 
} 

} 
//查 
function select($field="*",$arraywhere="",$order="",$limit=""){ 
if(!empty($arraywhere)){ 
$strw = " where "; 
foreach($arraywhere as $kw=>$vw){ 
$kn=str_replace(":","",$kw);
if(count($arraywhere)==1){ 
$strw .= $kn."=".$kw; 

}else{ 
$strw .= $kn."=".$kw." and "; 
}
}
if(count($arraywhere)>1){ 
$strw .= " 1=1 "; 
}
} 
if(!empty($order)){ 
$order="order by ".$order; 
} 
if(!empty($limit)){ 
$limit="limit ".$limit; 
}
//select 字段列表 from 表名 where 条件 order by 字段 desc|asc limit start,length; 
$sql="select {$field} from {$this->tablename} {$strw} {$order} {$limit}"; 
//print_r($sql); 
$pdos=$this->pob->prepare($sql); 
if(!empty($arraywhere)){ 
foreach($arraywhere as $kw=>$vw){ 
$kn=str_replace(":","",$kw); 
$$kn=$vw; 
if(is_int($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else if(is_float($vw)){ 
$pdos->bindparam($kw,$$kn,pdo::param_int); 
}else{ 
$pdos->bindparam($kw,$$kn,pdo::param_str); 
} 
} 
} 
$re=$pdos->execute(); 
if($re){ 
$pdos->setfetchmode(pdo::fetch_assoc); 
return $pdos->fetchall(); 
}else { 
return false; 
} 

} 


}