Convert PHP query textarea input to PDO format with jQuery.

by Michael Prosser

HTML

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js"></script>

SAMPLE QUERY: "UPDATE user SET fname = '".$fname."', lname = '".$lname."' WHERE id = '".$id."'"

CSS

.sqli-to-pdo{
  font-family: helvetica;
}
.sqli-to-pdo>textarea{
  width: calc(100% - 22px);
  height: 100px;
  padding: 10px;
  border: solid 1px #999;
  font-family: helvetica;
}

JavaScript

class SQLI_TO_PDO {

  constructor (parentElement){

    this.parentElement = parentElement;
    this.ui;

    this.build();

  }

  build(){

    this.ui = $(`<div class="sqli-to-pdo"><textarea class="query-input" placeholder="Enter Your PHP Query Code Here..."></textarea><button class="convert-button">Convert</button><div class="query-output"></div>`);

    this.parentElement.append(this.ui);

    let input = this.ui.find('textarea.query-input');

    this.ui.find('button.convert-button').click(function(){

      let v = input.val();

      let bits = v.split('.');

      // all in peices - determine how it should be put back together

      /*
      start by checking for false positives where the . is used in 
      stricter lookups of aliases
      if both the last character of previous bit and first 
      character of this bit are a value and it is not a $
      */

      let constructed_string = '';
      let constructed_array = [];

      for(let i=0;i<bits.length;i++){

        if(i>0){

          if(
            (bits[i].substr(0,1) == '$') || 
            (bits[i].substr(0,2) == ' $') || 
            (bits[i].substr(0,3) == '  $') || 
            (bits[i].substr(0,24) == 'mysql_real_escape_string') || 
            (bits[i].substr(0,25) == ' mysql_real_escape_string')
            ){

            constructed_string += '?';

            constructed_array.push(bits[i].trim());

          } else {

            // clean up the wrappers

            bits[i] = bits[i].replaceAll("'",'');
            bits[i] = bits[i].replaceAll('"','');
            bits[i] = bits[i].replaceAll('   ',' ');
            bits[i] = bits[i].replaceAll('  ',' ');

            

            console.log("bits[i]: " + bits[i]);


            constructed_string += bits[i];

          }

        } else {

          if(bits[i].substr(0,1) == '"'){

            bits[i] = bits[i].substr(1);

          }

         ...