我做 PDO 对吗？准备好的语句的第一个计时器

Question

刚刚更改了我之前的问题，以反映每个人都告诉我要做的 PDO 更改。我这样做对吗？错误报告对吗？一切都安全吗？

刚刚更改了我之前的问题，以反映每个人都告诉我要做的 PDO 更改。我这样做对吗？错误报告对吗？一切都安全吗？

try{
$connection = new PDO('mysql:host=supertopsecret;dbname=supertopsecret;charset=utf8mb4', 
'supertopsecret', 'supertopsecret');
$connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$connection->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

//Query 1 - Insert Provider's Name
//if(isset($_POST['submit'])){ delete this? do I still use this? halp
$stmt1 = $connection->prepare("INSERT INTO 
`providers`(provider_first_name,provider_last_name,date_added)
VALUES (:providerfirstname, :providerlastname, NOW())");

//bind parameters:
  $stmt1->bindParam(':providerfirstname', $providerfirstname);
  $stmt1->bindParam(':providerlastname', $providerlastname);

//insert row
  $providerfirstname = $_POST['providerfirstname'];
  $providerlastname = $_POST['providerlastname'];

  $stmt1->execute();

//Query 2 - Insert Practices
$prov_id = $connection->lastInsertId();
  /*Get all values of practice_name[]:*/
  $practicename = $_POST['practice_name'];
  for ($i = 0; $i < count($practicename); $i++) {
      if ($practicename[$i]) {
          $practice_name_data = $practicename[$i];


      $stmt2 = $connection->prepare("INSERT INTO 
practices(prov_id,practice_name) VALUES (:prov_id,:practice_name)");

      $stmt2->bindParam(':prov_id', $prov_id);
      $stmt2->bindParam(':practice_name', $practice_name_data);

      $stmt2->execute();
     }
  }


echo '<center><h3><br><br><br>Thank you! Your provider has 
successfully been submitted to the database!</center></h3></br>';

} catch(PDOException $e){
echo "Sorry, there was an problem submitting your provider to the 
database. Please try again or copy and paste the error code below to 
the \"Report a Problem\" page and we will try to correct the problem. 
</b></br></br> Error: " . $e->getMessage();
die();
}
$connection = null;

Answer 1

您应该使用准备好的语句而不是转义自己，请参阅How can I prevent SQL injection in PHP?。但它可能是'$practicename[$i]'。应该是'{$practicename[$i]}'，但更简单：

foreach($practicename as $value){
   if($value!=""){
       $value =  mysqli_real_escape_string($connection, $value);
       $query2 = mysqli_query($connection,
       "INSERT INTO `practices`(prov_id,practice_name) 
        VALUES ('$prov_id','$value')");
   }
}

但同样，放弃这个并使用Prepared Statements！

Answer 2

检查一下它可能会对您有所帮助。使用 PDO 进行插入。

$connection = new PDO("mysql:host=xxxx;dbname=xxxx;", "xxxx", "xxxx"); //database connection

for ($i = 0; $i < count($practicename); $i++) {
    if ($practicename[$i]) {
        $practice_name_data = $practicename[$i];

        $statement = $connection->prepare('INSERT INTO practices(prov_id,practice_name) VALUES (:prov_id,:practice_name)');

        $statement->bindParam(':prov_id', $prov_id);
        $statement->bindParam(':practice_name', $practice_name_data);
        // etc.

        $statement->execute();
    }
}