<?php

// db connection
/** overide native PDO function */
class database extends PDO {

	protected $query;

	public function __construct($dsn, $username = '', $password = '', $driver_options = array()) {
		parent::__construct($dsn, $username, $password, $driver_options);
		$this->setAttribute(PDO::ATTR_STATEMENT_CLASS, array('db_statement', array($this)));
	}

	public function last_query() {
		return $this->query;
	}

}

/** overide native PDO statement */
// for XSS protection
class db_statement extends PDOStatement {

	protected $pdo;

	protected function __construct($pdo) {
		$this->pdo = $pdo;
	}

	public function execute($args = null) {
		// Perform logging here. PDO object is accessible
		// from $this->pdo.

		if (!is_array($args)) {
			$args = func_get_args();
		}else{
			// Cast all values to string before XSS processing.
			// json_decode requires a string — integers, booleans, and nulls
			// passed as bound parameters would otherwise cause a TypeError.
			// null is preserved as-is so PDO can bind NULL columns correctly.
			$args = array_map(fn($v) => is_null($v) ? null : (string)$v, $args);

			// escaping array
			// prevent store XSS
			foreach($args as &$item){

				if (is_null($item)) continue;

				// decode the JSON data
				// set second parameter boolean TRUE for associative array output.
				$result = json_decode($item);
				if (json_last_error() === JSON_ERROR_NONE) {
					// encode html for json
					$tmp = json_decode($item,true);
					foreach((array)$tmp as &$ii){

						// Inner values may be arrays (nested JSON objects) — cast to string
						if (!is_string($ii)) {
							$ii = json_encode($ii);
							continue;
						}

						$result = json_decode($ii);
						if (json_last_error() === JSON_ERROR_NONE) {
							// json inside json
							$tmpp = json_decode($ii,true);
							foreach ((array)$tmpp as &$iii) {
								$iii = htmlspecialchars($ii, ENT_QUOTES, 'UTF-8');
							}
							$ii = json_encode($tmpp);
						}else{
							// string inside json
							$ii = htmlspecialchars($ii, ENT_QUOTES, 'UTF-8');
						}
						
					}
					$item = json_encode($tmp);
				}else{
					// encode html for string
					$item = htmlspecialchars($item, ENT_QUOTES, 'UTF-8');
				}
			}
		}
		return parent::execute($args);
	}

}

//..................... PDO1 .....................//
$pdo1 = new database($db_type.':host='.$db_server.';dbname='.$db_database.';charset=utf8', $db_user, $db_pass);
$pdo1->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

//..................... PDO2 .....................//
$pdo2 = new database($db_type2.':host='.$db_server2.';dbname='.$db_database2.';charset=utf8', $db_user2, $db_pass2);
$pdo2->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);