Related knowledge about PHP MySQL prepared statements

PHP MySQL prepared statements are very important in PHP. This article will learn about PHP MySQL prepared statements in detail.

Preprocessed statements and bound parameters

Preprocessed statements are used to execute multiple identical SQL statements with higher execution efficiency.

Preprocessing statements work as follows:

Preprocessing: Create a SQL statement template and send it to the database. Reserved values ​​are marked with the parameter "?". For example:

INSERT INTO MyGuests (firstname, lastname, email) VALUES(?, ?, ?)

Database parsing, compilation, query optimization on SQL statement templates, and storage The result is not output.

Execution: Finally, the application-bound value is passed to the parameter ("?" mark), and the database executes the statement. The application can execute the statement multiple times if the parameter values ​​are different.

Compared with directly executing SQL statements, prepared statements have two main advantages:

Preprocessed statements greatly reduce analysis time and only make one query (although the statement is executed multiple times) .

Bind parameters reduce server bandwidth, you only need to send the parameters of the query instead of the entire statement.

Preprocessed statements are very useful for SQL injection, because different protocols are used after the parameter values ​​are sent, ensuring the legality of the data.

MySQLi prepared statements

The following examples use prepared statements in MySQLi and bind corresponding parameters:

Examples (MySQLi uses prepared statements)

<?php$servername = "localhost";$username = "username";$password = "password";$dbname = "myDB"; 
// 创建连接$conn = new mysqli($servername, $username, $password, $dbname); 
// 检测连接if ($conn->connect_error) {
    die("连接失败: " . $conn->connect_error);}
 // 预处理及绑定$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");$stmt->bind_param("sss", $firstname, $lastname, $email); 
// 设置参数并执行$firstname = "John";$lastname = "Doe";$email = "john@example.com";$stmt->execute(); 
$firstname = "Mary";$lastname = "Moe";$email = "mary@example.com";$stmt->execute(); 
$firstname = "Julie";$lastname = "Dooley";$email = "julie@example.com";$stmt->execute(); 
echo "新记录插入成功"; 
$stmt->close();$conn->close();?>

Parse each line of code in the following example:

"INSERT INTO MyGuests (firstname, lastname, email) VALUES(?, ?, ?)"

In the SQL statement , we used a question mark (?), where we can replace the question mark with integer, string, double float and boolean.

Next, let’s take a look at the bind_param() function:

$stmt->bind_param("sss", $firstname, $lastname, $email);

This function binds SQL parameters and tells the database the value of the parameters. The "sss" parameter column handles the data type of the remaining parameters. The s character tells the database that the parameter is a string.

The parameters have the following four types:

i - integer (integer type)

d - double (double precision floating point type)

s - string (string)

b - BLOB (binary large object: binary large object)

Each parameter needs to specify the type.

By telling the database the data type of the parameter, you can reduce the risk of SQL injection.

Note: If you want to insert other data (user input), validation of the data is very important.

Prepared statements in PDO

In the following examples, we use prepared statements and bind parameters in PDO:

Examples (PDO uses prepared statements)

<?php$servername = "localhost";$username = "username";$password = "password";$dbname = "myDBPDO"; 
try {
    $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);    // 设置 PDO 错误模式为异常
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
    // 预处理 SQL 并绑定参数
    $stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) 
    VALUES (:firstname, :lastname, :email)");    $stmt->bindParam(&#39;:firstname&#39;, $firstname);    $stmt->bindParam(&#39;:lastname&#39;, $lastname);    $stmt->bindParam(&#39;:email&#39;, $email); 
    // 插入行
    $firstname = "John";    $lastname = "Doe";    $email = "john@example.com";    $stmt->execute(); 
    // 插入其他行
    $firstname = "Mary";    $lastname = "Moe";    $email = "mary@example.com";    $stmt->execute(); 
    // 插入其他行
    $firstname = "Julie";    $lastname = "Dooley";    $email = "julie@example.com";    $stmt->execute(); 
    echo "新记录插入成功";}catch(PDOException $e){
    echo "Error: " . $e->getMessage();}$conn = null;?>

This article explains in detail the relevant knowledge of PHP mysql preprocessing statements. For more learning materials, please pay attention to the PHP Chinese website.

Related recommendations:

How to insert multiple pieces of data through PHP MySQL

How to insert data through PHP MySQL

How to create a MySQL table through PHP

The above is the detailed content of Related knowledge about PHP MySQL prepared statements. For more information, please follow other related articles on the PHP Chinese website!