Pre-processing of PHP mysqli extensions

Source: Internet
Author: User
Tags php define prepare

In the previous article mysqli basic knowledge of mysqli installation and basic operations (mainly a single SQL statement query operations), today is a very important part of mysqli: preprocessing.

Its three main classes are often involved in mysqli operations: The Mysqli class, the Mysql_stmt class, and the Mysqli_result class. Preprocessing is mainly done by using the Mysql_stmt class.

Preprocessing is an important means to prevent SQL injection, which is of great significance to improve the security of the website.

In this case, the database name is test, the data table name is test, the field has ID, title two, id from the growth of the primary key.


To perform an insert operation using MYSQLI preprocessing:

<?php define ("HOST", "localhost");d efine ("USER", ' root ');d efine ("PWD", "');d efine (" DB ", ' Test '); $mysqli =new Mysqli (HOST,USER,PWD,DB), if ($mysqli->connect_errno) {    "Connect Error:". $mysqli->connect_error;} $mysqli->set_charset (' UTF8 '); $id = "; $title = ' title4 ';///use? Replace the variable $sql= "INSERT test VALUES (?,?)"; /Get $mysqli_stmt object, must remember to pass $sql, preprocessing is the preprocessing of SQL statement. $mysqli _stmt= $mysqli->prepare ($sql);//The first parameter indicates a variable type, with I (int), d (Double), S (string), B (BLOB) $mysqli _stmt->bind_ Param (' is ', $id, $title); The second argument of Bind_param cannot write the value directly, it must be passed with a variable//execute the Preprocessing statement if ($mysqli _stmt->execute ()) {    echo $mysqli _stmt->insert_id ;} else{    echo $mysqli _stmt->error;} $mysqli->close ();

Query validation using MYSQLI preprocessing (login and other scenario applications):

$id = ' 4 '; $title = ' title4 '; $sql = "SELECT * FROM Test WHERE id=? and title=? "; $mysqli _stmt= $mysqli->prepare ($sql) $mysqli _stmt->bind_param (' is ', $id, $title); if ($mysqli _stmt-> Execute ()) {    $mysqli _stmt->store_result ();    if ($mysqli _stmt->num_rows () >0) {        echo "verified success";    } else{        echo "validation failed";    }}    $mysqli _stmt->free_result ();    $mysqli _stmt->close ();

To execute a query statement using MYSQLI preprocessing:

$sql = "Select Id,title from Test WHERE id>=?"; $mysqli _stmt= $mysqli->prepare ($sql) $id =1; $mysqli _stmt->bind_param (' i ', $id); if ($mysqli _stmt->execute ( ) {    $mysqli _stmt->store_result ();
Binds a variable to a prepared statement for the result store $mysqli _stmt->bind_result ($id, $title); while ($mysqli _stmt->fetch ()) { echo $id. ': '. $title. ' <br/> '; }}

For more mysqli technology, please refer to the official PHP manual, which is the best way to learn.

Pre-processing of PHP mysqli extensions

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.