Xtykutl

I have a function that i call everytime i want to execute a query, but after awhile i notice that if an input had a ' , it would lead to an SQL error. But i kept building my website with this function (and i start to think it might not have been the best idea).

I want to rewrite this function but with the same parameter it had before, wich is only the SQL, i searched everywhere and i only saw examples like this one:

$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');

$stmt->execute(array('name' => $name));

Quoting this answer: here

But my function looks like this:

function query($sql) {

    $stmt = $this->conn->prepare($sql);

    $stmt->execute();

    return $stmt;

}

pretty basic, but i thought at that time it would be enough.

And my problem with this is that i have a couple of complicated queries, so i'm trying to find a way to only use the SQL as a parameter. And not create an array to insert in the function in the execute as shown above.

Isn't there any other way to create a function where i can fix my aphostrophe, but still have only that one parameter?

ps: I disabled the emulation of prepared statments to help against SQL Injection.

Thanks for help.