Srs, boa tarde!
Com o uso do PDO. A função mysqli_real_escape_string neste cenário torna-se desnecessária?
function setItem(){
global $itemDao;
$itemFactory = new ItemFactory();
$item = $itemFactory->createItem($_POST);
$item->setCodItem($itemDao->getLastItem());
return $item;
}
function createItem($params){
/* old
$desc_item = mysqli_real_escape_string(Connection::connect(), $params['desc_item']);
$price = mysqli_real_escape_string(Connection::connect(), $params['price']);
$category = mysqli_real_escape_string(Connection::connect(), $params['category']);
$status = mysqli_real_escape_string(Connection::connect(), $params['status']);*/
$desc_item = $params['desc_item'];
$price = $params['price'];
$category = $params['category'];
$status = $params['status'];
return new Item($desc_item, $price, $category, $status);
function item_dataBase_insert($connection, Item $item){
$query = "INSERT INTO item(cod_item, desc_item, price, category, status)
VALUES(:cod_item, :desc_item, :price, :category, :status)";
$stmt = $connection->prepare($query);
$stmt->bindValue(':cod_item', $item->getCodItem());
$stmt->bindValue(':desc_item', $item->getDescItem());
$stmt->bindValue(':price', $item->getPrice());
$stmt->bindValue(':category', $item->getCategory());
$stmt->bindValue(':status', $item->getStatus());
$stmt->execute();
}