問題描述
我的網站相當廣泛，我最近才切換到 PHP5(稱我為大器晚成的人).
My site is rather extensive, and I just recently made the switch to PHP5 (call me a late bloomer).
我之前所有的 MySQL 查詢都是這樣構建的:
All of my MySQL query's before were built as such:
"SELECT * FROM tablename WHERE field1 = 'value' && field2 = 'value2'";
這使它變得非常容易、簡單和友好.
This made it very easy, simple and friendly.
出于明顯的安全原因，我現在正在嘗試切換到 mysqli，并且我很難弄清楚如何在 bind_param<時實現相同的 SELECT * FROM 查詢/code> 需要特定參數.
I am now trying to make the switch to mysqli for obvious security reasons, and I am having a hard time figuring out how to implement the same SELECT * FROM queries when the bind_param requires specific arguments.
這句話是過去式了嗎?
如果是，我該如何處理涉及大量列的查詢?我真的需要每次都把它們都打出來嗎?
If it is, how do I handle a query with tons of columns involved? Do I really need to type them all out every time?
推薦答案
"SELECT * FROM tablename WHERE field1 = 'value' && field2 = 'value2'";
變成
"SELECT * FROM tablename WHERE field1 = ? && field2 = ?";
傳遞給 $mysqli::prepare:
$stmt = $mysqli->prepare(
"SELECT * FROM tablename WHERE field1 = ? && field2 = ?");
$stmt->bind_param( "ss", $value, $value2);
// "ss' is a format string, each "s" means string
$stmt->execute();
$stmt->bind_result($col1, $col2);
// then fetch and close the statement
OP 評論:
所以如果我有 5 個參數，我可能會有sssis"或其他東西(取決于輸入的類型?)
so if i have 5 parameters, i could potentially have "sssis" or something (depending on the types of inputs?)
對，準備好的語句中每個 ? 參數都有一個類型說明符，所有這些都是位置說明符(第一個說明符適用于第一個 ? ，它被第一個實際參數(哪個是 bind_param)) 的第二個參數.
Right, one type specifier per ? parameter in the prepared statement, all of them positional (first specifier applies to first ? which is replaced by first actual parameter (which is the second parameter to bind_param)).
這篇關于MySQLi 中的 SELECT * FROM的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！