从程序语句转换为 mysqli 准备语句答案

【问题标题】：Convert to mysqli Prepared Statements from Procedural ones从程序语句转换为 mysqli 准备语句
【发布时间】：2014-01-13 01:44:44
【问题描述】：

我需要以下代码的帮助才能将其从过程更改为准备语句。我会尽力编写代码：

默认程序脚本MYSQLI默认

<?php
$conn = mysqli_connect ('localhost', 'gggggg', 'gggggg') ; 
mysqli_select_db ($conn, 'ggggg'); 

$anti_injection = mysqli_real_escape_string($_GET['user']);

$sql = "SELECT * FROM profiles WHERE username =".$anti_injection);
$result = mysqli_query($conn, $query);

while($row = mysqli_fetch_array($sql)) {

$username = stripslashes($row['username']);
$age = stripslashes($row['age']);
$gender = stripslashes($row['gender']);
?>


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>title</title>
</head>

<body>
CUSTOM HTML FOR A NICE DESIGN I WANT TO KEEP THE SAME DESIGN LAYOUT ETC...

    CATEGORY <?php echo $username; ?>
    TITEL <?php echo $age; ?>
    CONTENT <?php echo $sex; ?>

</body>
</html>
<?php
}
?>

现在我对声明的更改希望它有效

$query = $sql->prepare("SELECT * FROM profiles WHERE `username`=?")
$prep->bind_param("s",$anti_injection);
$prep->execute();

这就是我在安全模式下对 SELECT 的了解，但是对于 MYSQLI_FETCH_ARRAY，我真的不知道它会起作用，希望如果有机会通过 HTML BODY 页面之间的回声保持脚本的方式我喜欢

关于必须如何完成的一些示例？

【问题讨论】：

我想知道 $prep 变量是什么？
php.net/manual/en/mysqli.quickstart.prepared-statements.php
连我自己都不知道。我只是从另一个例子中复制了它们，我试图弄清楚它是如何在没有运气的情况下完成的:(
我只是想向大家学习。 Emilio 的回答并没有太大帮助，因为它向专家展示了如何做，但像我这样的菜鸟不会理解这种例子，这就是为什么我用我的例子创建帖子来学习和理解我正在学习的内容

标签： php mysql mysqli statements procedural

【解决方案1】：

首先，我强烈建议您不要将程序与对象混合。这样会更快地变得混乱。考虑改用mysqli 对象。

$mysqli = new mysqli('localhost'...);

第二，你很接近，但正如我所说，你正在混合对象和程序，所以你改变它的方式不会起作用。另外，您在整个地方都在弹跳变量（如果您原始运行更改，它将失败）。假设您如上所述切换到mysqli 对象，您可以这样做

$prep = $mysqli->prepare("SELECT * FROM profiles WHERE `username`=?");
$prep->bind_param("s",$anti_injection);
$prep->execute();

现在，下一部分很棘手。您必须安装mysqlnd 才能执行此操作，但这是恢复结果的最佳方式。如果您运行此程序并收到有关缺少 get_result 的错误，则说明您没有运行 mysqlnd

$result = $prep->get_result();
while($row = $result->fetch_array()) {
    //Your HTML loop here
}

【讨论】：

我会试试看是否启用了ty m8
没有运气致命错误：调用未定义的方法 mysqli_stmt::get_result() in
那真是太可惜了。如果你不能改变你的服务器环境，你将不得不使用相当笨重的bind_result

【解决方案2】：

我提供了一个基于你的脚本，我已经评论、测试并使用了程序“mysqli”。希望它会澄清一些事情。

<?php
/* (PHP 5.3.18 on XAMPP, windows XP)
 *
 * I will use the procedural 'mysqli' functions in this example as that is
 * what you seem familiar with.
 *
 * However, the 'object oriented' style is preferred currently.
 *
 * It all works fine though :-)
 *
 * I recommend PDO (PHP Data Objects) as the way to go for Database access
 * as it provides a 'common' interface to many database engines.
 */


// this is an example 'select' parameter -- how this value gets set is up to you...
// use a form, get parameter or other, it is not important.

$bindparamUsername = 'user_2'; // example!!!!

// connect to the database...
$dbConnection = mysqli_connect('localhost', 'test', 'test'); // connect
mysqli_select_db($dbConnection, 'testmysql'); // my test database


// the SQL Query...

// the '?' is a placeholder for a value that will be substituted when the query runs.
// Note: the ORDER of the selected Columns is important not the column names.
//
// Note: The number of selected columns is important and must match the number of
// 'result' bind variables used later.

$sql = "SELECT username, age, gender FROM profiles WHERE username = ?";

// DB engine: parse the query into an internal form that it understands
$preparedQuery = mysqli_prepare($dbConnection, $sql);

// bind an actual input PHP variable to the prepared query so the db will have all required values
// when the query is executed.
//
mysqli_stmt_bind_param($preparedQuery, 's', $bindparamUsername);

// run the query...
$success = mysqli_execute($preparedQuery);


// You can only bind which variables to store the result columns in AFTER the query has run!
//

// Now bind where any results from the query will be returned...
// There must be as many 'bind' variables as there are selected columns!
// This is because each column value from the query will be returned into the 
// 'bound' PHP variable. 
//
// Note: You cannot bind to an array. You must bind to an individual PHP variable.
//
// I have kept the same names but they are only of use to you.
$fetchedRow = array( 'username' => null,
                     'age'      => null,
                     'gender'   => null);


/*
 *  Note: order of columns in the query and order of destination variables in the       'bind' statement is important.
 *  
 *  i.e. $fetchedRow[username] could be replaced with variable $firstColumn,
 *       $fetchedRow[age] could be replaces with variable $secondColumn
 *   and so on...  
 *     
 * There must be as many bind variables as there are columns.             
 */   
mysqli_stmt_bind_result($preparedQuery, $fetchedRow['username'],
                                        $fetchedRow['age'],
                                        $fetchedRow['gender']);

 /*
 * Note: if you use the 'Object Oriented' version of 'mysqli': All of this is 'hidden'
 *       but still happens 'behind the scenes'!
 *
 */
?>

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title></title>
  </head>
  <body>
    CUSTOM HTML FOR A NICE DESIGN I WANT TO KEEP THE SAME DESIGN LAYOUT ETC...

    <?php // each 'fetch' updates the $fetchedRow PHP variable... ?>
    <?php while (mysqli_stmt_fetch($preparedQuery)): ?>
      <br />
        CATEGORY <?php echo $fetchedRow['username']; ?>
      <br />
      TITEL <?php echo $fetchedRow['age']; ?> <br />
      CONTENT <?php echo $fetchedRow['gender']; ?> <br />
    <?php endwhile ?>

  </body>
</html>

【讨论】：

我会对其进行测试，但看起来非常有趣且易于理解，非常感谢您的宝贵时间

【解决方案3】：

如果你正在学习，我鼓励你使用Object Oriented Style

Manual 是您可以找到最准确信息的第一个资源。按照你的例子：

$mysqli = new mysqli("example.com", "user", "password", "database");
if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}

//Here you avoid the warning undefine variable if $_GET['user'] ins't set
$user = isset($_GET['user']) ? $_GET['user'] : NULL;
$row = array();

//Checking if $user is NULL
if(!empty($user)){
   // Prepared statement, stage 1: prepare 
   if (!($stmt = $mysqli->prepare("SELECT * FROM profiles WHERE `username`=?"))) {
     echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
   }
   /* Prepared statement, stage 2: bind and execute */
   if (!$stmt->bind_param("s", $user)) {
     echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
   }
   if (!$stmt->execute()) {
     echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
   }
  //Fetching the result
  $res = $stmt->get_result();
  $row = $res->fetch_assoc();
  /* explicit close recommended */
  $stmt->close();
}else{
//do this code if $user is null
}


//Printing out the result
echo '<pre>';
print_r($row);
echo '</pre>';

【讨论】：

【解决方案4】：

你可以这样做

$link = mysqli_connect("localhost", "my_user", "my_password", "db"); //Establishing connection to the database , this is alias of new mysqli('')
$query="SELECT * FROM profiles WHERE `username`=?";
$stmt = $link->prepare($query);
$stmt->bind_param("s",$anti_injection); // binding the parameter to it
$stmt->execute(); //Executing
$result = $stmt->get_result();
while($row = $result->fetch_array(MYSQLI_ASSOC)) // we used MYSQLI_ASSOC flag here you also can use MYSQLI_NUM or MYSQLI_BOTH
{
//Do stuff
}

【讨论】：

我现在就给它一个测试，想知道为什么#query="SELECT * FROM profiles WHERE username=?"您使用 # 符号编辑
试过了，甚至 Dreamweaver 在从配置文件中选择类似查询时给我一个错误...似乎缺少某些符号
我确信其中没有语法错误。此外，根据@Machavity 上的 cmets，您的服务器的 php 低于 5.3，因为 php >= 5.3 支持 get_result
为了记录，您的连接是程序性的，您随后的 mysqli 调用是 OO。努力使用一种或另一种方式。