Php 将程序语句转换为mysqli准备语句_Php_Mysql_Mysqli_Statements_Procedural

Php 将程序语句转换为mysqli准备语句

php mysql

Php 将程序语句转换为mysqli准备语句,php,mysql,mysqli,statements,procedural,Php,Mysql,Mysqli,Statements,Procedural,我需要以下代码的帮助，以将其从程序性语句更改为准备好的语句。我将尽我所能对其进行编码：默认过程脚本MYSQLI Default <?php $conn = mysqli_connect ('localhost', 'gggggg', 'gggggg') ; mysqli_select_db ($conn, 'ggggg'); $anti_injection = mysqli_real_escape_string($_GET['user']); $sql = "SELECT * F

我需要以下代码的帮助，以将其从程序性语句更改为准备好的语句。我将尽我所能对其进行编码：

默认过程脚本MYSQLI Default

<?php
$conn = mysqli_connect ('localhost', 'gggggg', 'gggggg') ; 
mysqli_select_db ($conn, 'ggggg'); 

$anti_injection = mysqli_real_escape_string($_GET['user']);

$sql = "SELECT * FROM profiles WHERE username =".$anti_injection);
$result = mysqli_query($conn, $query);

while($row = mysqli_fetch_array($sql)) {

$username = stripslashes($row['username']);
$age = stripslashes($row['age']);
$gender = stripslashes($row['gender']);
?>


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>title</title>
</head>

<body>
CUSTOM HTML FOR A NICE DESIGN I WANT TO KEEP THE SAME DESIGN LAYOUT ETC...

    CATEGORY <?php echo $username; ?>
    TITEL <?php echo $age; ?>
    CONTENT <?php echo $sex; ?>

</body>
</html>
<?php
}
?>

这就是我所知道的在安全模式下选择脚本的全部内容，但是对于MYSQLI_FETCH_数组，我真的不知道它会起作用，希望有机会让脚本以我喜欢的方式在HTML主体页面之间进行回音

关于必须如何做的一些示例？

首先，我强烈建议您不要将过程对象与对象混合使用。那样会更快地让人困惑。考虑使用MySQL对象代替.< /P>

$mysqli = new mysqli('localhost'...);

第二，你很接近，但正如我所说，你混合了对象和程序，所以你改变的方式不起作用。另外，如果您运行原始更改，则会失败，您会到处跳转变量。假设您如上所述切换到mysqli对象，则可以执行此操作

$prep = $mysqli->prepare("SELECT * FROM profiles WHERE `username`=?");
$prep->bind_param("s",$anti_injection);
$prep->execute();

现在，下一部分很棘手。您必须安装mysqlnd才能执行此操作，但这是返回结果的最佳方式。如果您运行此命令并得到一个关于get_结果丢失的错误，那么您不是在运行mysqlnd

你可以这样做

$link = mysqli_connect("localhost", "my_user", "my_password", "db"); //Establishing connection to the database , this is alias of new mysqli('')
$query="SELECT * FROM profiles WHERE `username`=?";
$stmt = $link->prepare($query);
$stmt->bind_param("s",$anti_injection); // binding the parameter to it
$stmt->execute(); //Executing
$result = $stmt->get_result();
while($row = $result->fetch_array(MYSQLI_ASSOC)) // we used MYSQLI_ASSOC flag here you also can use MYSQLI_NUM or MYSQLI_BOTH
{
//Do stuff
}

如果你正在学习，我鼓励你使用面向对象的风格

是您可以找到最准确信息的第一个资源。以你为例：

$mysqli = new mysqli("example.com", "user", "password", "database");
if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}

//Here you avoid the warning undefine variable if $_GET['user'] ins't set
$user = isset($_GET['user']) ? $_GET['user'] : NULL;
$row = array();

//Checking if $user is NULL
if(!empty($user)){
   // Prepared statement, stage 1: prepare 
   if (!($stmt = $mysqli->prepare("SELECT * FROM profiles WHERE `username`=?"))) {
     echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
   }
   /* Prepared statement, stage 2: bind and execute */
   if (!$stmt->bind_param("s", $user)) {
     echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
   }
   if (!$stmt->execute()) {
     echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
   }
  //Fetching the result
  $res = $stmt->get_result();
  $row = $res->fetch_assoc();
  /* explicit close recommended */
  $stmt->close();
}else{
//do this code if $user is null
}


//Printing out the result
echo '<pre>';
print_r($row);
echo '</pre>';

我提供了一个基于您的脚本，我已经对该脚本进行了评论、测试并使用了程序“mysqli”。希望它能澄清问题

我想知道$prep变量是什么？连我都不知道。我只是从另一个例子中复制了它们，我试图弄清楚它是如何在没有运气的情况下完成的：我只是想学习男生。Emilio的回答没有太大帮助，因为它显示了如何为专家做些什么，但像我这样的Noobie不会理解这种例子，这就是为什么我用我的例子创建了这篇文章来学习和理解我所学的内容。我现在就给它一个测试，想知道为什么查询=SELECT*from profiles WHERE username=？你用symbolTried编辑了它，甚至Dreamweaver在从配置文件中选择的类似查询中也给了我一个错误。。。似乎缺少了一些符号。我确信其中没有语法错误。另外，根据您在@Machavity上的评论，您的服务器的php低于5.3，因为get_result受php>=5.3支持。请注意，您的连接是过程性的，后续的mysqli调用是OO。我将尝试看看它是否启用了ty m8No luck致命错误：调用未定义的方法mysqli\u stmt:：get\u result inMajor bummer then。如果你不能改变你的服务器环境，你将不得不使用相当笨重的我将测试它，但看起来非常有趣和容易理解，非常感谢你的时间

$link = mysqli_connect("localhost", "my_user", "my_password", "db"); //Establishing connection to the database , this is alias of new mysqli('')
$query="SELECT * FROM profiles WHERE `username`=?";
$stmt = $link->prepare($query);
$stmt->bind_param("s",$anti_injection); // binding the parameter to it
$stmt->execute(); //Executing
$result = $stmt->get_result();
while($row = $result->fetch_array(MYSQLI_ASSOC)) // we used MYSQLI_ASSOC flag here you also can use MYSQLI_NUM or MYSQLI_BOTH
{
//Do stuff
}

$mysqli = new mysqli("example.com", "user", "password", "database");
if ($mysqli->connect_errno) {
    echo "Failed to connect to MySQL: (" . $mysqli->connect_errno . ") " . $mysqli->connect_error;
}

//Here you avoid the warning undefine variable if $_GET['user'] ins't set
$user = isset($_GET['user']) ? $_GET['user'] : NULL;
$row = array();

//Checking if $user is NULL
if(!empty($user)){
   // Prepared statement, stage 1: prepare 
   if (!($stmt = $mysqli->prepare("SELECT * FROM profiles WHERE `username`=?"))) {
     echo "Prepare failed: (" . $mysqli->errno . ") " . $mysqli->error;
   }
   /* Prepared statement, stage 2: bind and execute */
   if (!$stmt->bind_param("s", $user)) {
     echo "Binding parameters failed: (" . $stmt->errno . ") " . $stmt->error;
   }
   if (!$stmt->execute()) {
     echo "Execute failed: (" . $stmt->errno . ") " . $stmt->error;
   }
  //Fetching the result
  $res = $stmt->get_result();
  $row = $res->fetch_assoc();
  /* explicit close recommended */
  $stmt->close();
}else{
//do this code if $user is null
}


//Printing out the result
echo '<pre>';
print_r($row);
echo '</pre>';

<?php
/* (PHP 5.3.18 on XAMPP, windows XP)
 *
 * I will use the procedural 'mysqli' functions in this example as that is
 * what you seem familiar with.
 *
 * However, the 'object oriented' style is preferred currently.
 *
 * It all works fine though :-)
 *
 * I recommend PDO (PHP Data Objects) as the way to go for Database access
 * as it provides a 'common' interface to many database engines.
 */


// this is an example 'select' parameter -- how this value gets set is up to you...
// use a form, get parameter or other, it is not important.

$bindparamUsername = 'user_2'; // example!!!!

// connect to the database...
$dbConnection = mysqli_connect('localhost', 'test', 'test'); // connect
mysqli_select_db($dbConnection, 'testmysql'); // my test database


// the SQL Query...

// the '?' is a placeholder for a value that will be substituted when the query runs.
// Note: the ORDER of the selected Columns is important not the column names.
//
// Note: The number of selected columns is important and must match the number of
// 'result' bind variables used later.

$sql = "SELECT username, age, gender FROM profiles WHERE username = ?";

// DB engine: parse the query into an internal form that it understands
$preparedQuery = mysqli_prepare($dbConnection, $sql);

// bind an actual input PHP variable to the prepared query so the db will have all required values
// when the query is executed.
//
mysqli_stmt_bind_param($preparedQuery, 's', $bindparamUsername);

// run the query...
$success = mysqli_execute($preparedQuery);


// You can only bind which variables to store the result columns in AFTER the query has run!
//

// Now bind where any results from the query will be returned...
// There must be as many 'bind' variables as there are selected columns!
// This is because each column value from the query will be returned into the 
// 'bound' PHP variable. 
//
// Note: You cannot bind to an array. You must bind to an individual PHP variable.
//
// I have kept the same names but they are only of use to you.
$fetchedRow = array( 'username' => null,
                     'age'      => null,
                     'gender'   => null);


/*
 *  Note: order of columns in the query and order of destination variables in the       'bind' statement is important.
 *  
 *  i.e. $fetchedRow[username] could be replaced with variable $firstColumn,
 *       $fetchedRow[age] could be replaces with variable $secondColumn
 *   and so on...  
 *     
 * There must be as many bind variables as there are columns.             
 */   
mysqli_stmt_bind_result($preparedQuery, $fetchedRow['username'],
                                        $fetchedRow['age'],
                                        $fetchedRow['gender']);

 /*
 * Note: if you use the 'Object Oriented' version of 'mysqli': All of this is 'hidden'
 *       but still happens 'behind the scenes'!
 *
 */
?>

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title></title>
  </head>
  <body>
    CUSTOM HTML FOR A NICE DESIGN I WANT TO KEEP THE SAME DESIGN LAYOUT ETC...

    <?php // each 'fetch' updates the $fetchedRow PHP variable... ?>
    <?php while (mysqli_stmt_fetch($preparedQuery)): ?>
      <br />
        CATEGORY <?php echo $fetchedRow['username']; ?>
      <br />
      TITEL <?php echo $fetchedRow['age']; ?> <br />
      CONTENT <?php echo $fetchedRow['gender']; ?> <br />
    <?php endwhile ?>

  </body>
</html>