How to 'really' detect integers from DB?

I'm trying to save some code with the following. I've an object with variables named the same as table rows so I could create an insert like this one:

$query = "INSERT INTO table ";
        $columns = '(';
        $values = 'VALUES (';
        foreach ($this as $var => $value){
            if ($value){
                $columns .= $var.', ';
                if (!is_int($value))
                    $value = '\''.$value.'\'';
                $values .= $value.', ';
            }
        }
        $columns .= ')';
        $values .= ')';
        $columns = str_replace (', )', ')', $columns);
        $values = str_replace (', )', ')', $values);
        $query .= $columns." ".$values;

But every single 开发者_运维问答variable is detected as string and that's not true in all fields as you may imagine.

Does anyone have a solution?

Here's how I would write it:

<?php
$canonical_columns = array_flip(array("column1", "column2", "column3"));
$columns = array_keys(array_intersect_key($canonical_columns, (array) $this));
$params = join(",", array_fill(0, count($columns), "?"));
$columns = join(",", $columns);
$query = "INSERT INTO table ($columns) VALUES ($params)";
$stmt = $pdo->prepare($query);
$stmt->execute(array_values($this));

Stop concatenating fragments of strings to form SQL.

Use PDO, and use parameters for values.

Allowlist column names by comparing inputs to known, valid column names.

It appears as if you numbers are in fact strings. Try to use is_numeric() instead of is_int(). If this ain't enough you can cast the string to an integer and then check for != 0.

You may insert numbers in quotes too, as strings. This will not create an error.