【问题标题】:Prepared statement PHP OOP准备好的语句 PHP OOP
【发布时间】:2018-06-22 12:14:47
【问题描述】:

使用 PHP OOP 和 mysqli 在产品添加页面上工作,此时我正在处理准备好的语句实现,但找不到有关如何将它们添加到此类代码中的信息。

我们将不胜感激。

代码:

数据库连接类:

<?php
class DbConfig {    
    private $_host = 'localhost';
    private $_username = 'root';
    private $_password = 'falcons17';
    private $_database = 'scandiweb';

    protected $connection;

    public function __construct()
    {
      if (!isset($this->connection)) {
        $this->connection = new mysqli($this->_host, $this->_username, $this->_password, $this->_database);
        if (!$this->connection) {
          echo 'Cannot connect to database server';
          exit;
        }           
      } 

      return $this->connection;
    }
}
?>

执行函数:

public function execute($query) {
  $result = $this->connection->query($query);
  if ($result == false) {
    echo mysqli_error($this->connection); /*'Error: cannot execute the command'*/
    return false;
  } else {
    return true;
  }
}

验证和添加程序:

 <?php
//including the database connection file
include_once("classes/Crud.php");
include_once("classes/Validation.php");

$crud = new Crud();
$validation = new Validation();    
if(isset($_POST['Submit'])) {   
    $sku = $crud->prepare_string($_POST['sku']);
    $name = $crud->prepare_string($_POST['name']);
    $price = $crud->prepare_string($_POST['price']);
    $products = $crud->prepare_string($_POST['products']);
    $weight = $crud->prepare_string($_POST['weight']);
    $capacity = $crud->prepare_string($_POST['capacity']);
    $height = $crud->prepare_string($_POST['height']);
    $width = $crud->prepare_string($_POST['width']);
    $length = $crud->prepare_string($_POST['length']);

    $check_int = $validation->is_int($_POST, array('price','weight','capacity','height','width','length'));    
    if ($check_int != null){
      echo $check_int;
    }else {
      $result = $crud->execute("INSERT INTO products(sku,name,price,product_type,weight,capacity,height,width,length) VALUES('$sku','$name','$price','$products','$weight','$capacity','$height','$width','$length')");

      //display success message
      echo "<font color='green'>Data added successfully.";
      echo "<br/><a href='index.php'>View Result</a>";
    }
  }
?>

【问题讨论】:

  • 你看过documentation吗?哪些部分不清楚?
  • 在 __construct 中的返回是无用的,并且 __construct 不应该用于在其受保护时获取外部连接
  • 您的脚本对SQL Injection Attack 甚至if you are escaping inputs, its not safe! 都是开放的,在MYSQLI_PDO API 中使用prepared parameterized statements
  • 如果您准确描述您的问题/错误是什么会有所帮助
  • 什么是prepare_string?如果它正在转义数据,那么我强烈建议您停止这样做,而是使用准备好的/参数化的查询。如果你想要一个 db 类方法,你可能更喜欢使用 PDO 而不是 Mysqli,所以我建议试一试

标签: php oop mysqli prepared-statement


【解决方案1】:

这是我经常使用的一个类。它从一个单独的 .ini 文件中获取登录信息。随意更改您的需求。请记住,它将关联数组设置为标准。

class CC_DBV {

private static $mysqlhost; 
private static $mysqluser; 
private static $mysqlpwd; 
public static $mysqldb;
private static $db;
private static $mysqlport;


function __construct() {


    // ini File einlesen
    $globSettings = parse_ini_file(_ROOTV_.'cfg/main.ini',true);

    // Datenbankverbindung
    self::$mysqlhost = $globSettings ['db_settings']['host'];                   // MySQL-Host aus Config Datei
    self::$mysqluser = $globSettings ['db_settings']['db_user'];        // MySQL-User aus Config Datei
    self::$mysqlpwd = $globSettings ['db_settings']['db_pswd'];         // Passwort aus Config Datei
    self::$mysqldb = $globSettings ['db_settings']['db'];                       // Datenbank aus Config Datei
    self::$mysqlport = $globSettings ['db_settings']['port'];                   // Datenbank aus Config Datei

}

public function getInstance( ) { 
        if(!self::$db) { 

            try{

                self::$db = new \PDO( 
                        'mysql:host='.self::$mysqlhost.';dbname='.self::$mysqldb.';port='.self::$mysqlport, 
                        self::$mysqluser, 
                        self::$mysqlpwd, 
                        array( 
                                \PDO::ATTR_PERSISTENT => true, 
                                \PDO::ATTR_ERRMODE => \PDO::ERRMODE_EXCEPTION ,
                                \PDO::ATTR_DEFAULT_FETCH_MODE => \PDO::FETCH_ASSOC,
                                \PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'utf8'"
                        ) 
                ); 
                //self::$db->exec("SET NAMES utf8"); 

                return self::$db; 

            }catch (\PDOException $e){
                echo 'Connection failed: ' . $e->getMessage();
            }

        }else{
            return self::$db;
        }

} 

}

要使用它,你可以这样做:

$conn = new CC_DBV(); // you can use this connection multiple times, it's persistant.
$inst = $conn->getInstance(); // create or get the instance of the opened connection
$stmnt = $inst->prepare("SELECT * FROM tablename WHERE xyz = :VAR1"); // prepare statement with placeholder(s)
$v = array(':VAR1' => 'aValue'); // set up an array with corresponding values
$r1 = $stmnt->execute($v); // execute statement with values
if(!$r1){ echo "PANICMODE";}else{ var_dump($stmnt->fetchAll()));

【讨论】:

  • 这是 PDO,不是 mysqli。当然,PDO 也有我的偏好。
  • 是的,没错。但老实说 - 现在是 2018 年。Mysqli 应该消失了,即使是 OOP :)
  • 遗憾的是,这不是 SO 的工作方式。问题〜>解决答案。这可能已被标记为答案,但请相信我,这是一个例外。 'Knoop dat tussen je oren' ,正如我们用荷兰语所说,因为它将在未来帮助您。
  • 我承认 - 将他的问题误读为“我如何使用准备好的语句和 OOP”。对不起,Bedankt voor je advies!
猜你喜欢
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 2015-06-27
  • 1970-01-01
  • 2010-11-30
相关资源
最近更新 更多