Mysqli使用AJAX POST-to-PHP文件准备语句用法

我的问题是，PHP Mysqli编写的语句有多高效？据我从基础阅读中了解，准备好的语句1）有助于使用绑定输入的安全性2）通过某种程度上的“预打包”或“准备”sql查询来加速和“减少”发送到服务器的数据，一旦数据可用，它就将数据附加到准备好的语句并执行它。这也有助于在重复插入相同数据（不同值）时“重复”使用相同语句，因为语句只准备一次

现在，我正在构建一个具有多种功能的网站，所有（或大部分）功能都使用JQuery和AJAX获取用户输入，执行一些检查（在JS/JQ或PHP中），将数据发送到AJAX URL中指定的PHP文件PHP_AJAX_Handler.PHP。PHP文件准备SQL语句将数据插入数据库，然后返回JSON成功/失败消息。例如，我的大多数特性/功能编程如下：；下面是一个文件，我正在使用它1）检查现有的大陆国家对，2）插入新的大陆国家对

HTML:

PHP\u AJAX\u Handler.PHP

<?PHP       
session_start();
if( (isset($_POST['CT'])) && (isset($_POST['CN'])))
{ require_once ("golin_2.php");             
  $CN = $_POST['CN'];
  $CT = $_POST['CT'];
  $ER = "";
  $CONN = mysqli_connect($SERVER, $USER, $PASS, $DBNAME);
  If($CONN == FALSE) 
    { $ER = $ER . "Err: Conn Could not connect to Databse ".mysqli_connect_errno().' '.mysqli_connect_error();
    }
    else
    {   $SQL_1 = "SELECT * FROM sailors.continental_regions WHERE CONTINENT = ? AND COUNTRY = ?";   
    if(!($STMT_1 = mysqli_stmt_init($CONN)))
    {   $ER = $ER . "Err: Stmt Prepare Failed";
    }
    else
    {  if(!mysqli_stmt_prepare($STMT_1, $SQL_1))    ///FIRST SET of prepared statement lines
       {   $ER = $ER . "Err: Stmt Prepare Failed";
       }
       else
       {   if(!mysqli_stmt_bind_param($STMT_1,"ss",$CN, $CT))
           {   $ER = $ER . "Err: Stmt Prepare Failed";
        }
        else
        {   if(!(mysqli_stmt_execute($STMT_1)))
            {   $ER = $ER . "Err: Stmt_1 Execute Failed";
            }
            else
            {   $RES_1 = mysqli_stmt_get_result($STMT_1);
            $NUMROWS_1 = mysqli_num_rows($RES_1);
            if($NUMROWS_1>0)
            {  $ER = $ER . "Err: duplicate '$CN' '$CT' pair";
            }
            if($NUMROWS_1==0)
            {  $SQL_2 = "INSERT INTO DB.continental_regions (CONTINENT,COUNTRY) values (?, ?)";                     
               if(!($STMT_2=(mysqli_stmt_init($CONN))))
               {    $ER = $ER . "Err: Init2 failed";    
               }
               else
                   {    if(!mysqli_stmt_prepare($STMT_2, $SQL_2))     ///SECOND SET of prepared statement lines
                {   $ER = $ER . "Err: Prep2 failed".mysqli_error($CONN);    
                }
                else
                {   if(!mysqli_stmt_bind_param($STMT_2,"ss",$CN, $CT))
                    {   $ER = $ER . "Err: Bind2 failed";    
                    }
                    else
                    {   
                    if(!(mysqli_stmt_execute($STMT_2)))
                    {   $ER = $ER . "Err: Exec failed"; 
                    }
                    else
                    {   $arr['PASS'] = 'OK';    
                    }
                   }
                }
                }                                                   
            }
            }
        }
       }
    }
    mysqli_free_result($RES_1);
    mysqli_stmt_close($STMT_1);
    mysqli_stmt_close($STMT_2);
    mysqli_close($CONN);                            
   }        
   if($ER!=="")
   {   $arr['MSG'] = $ER;
       $arr['PASS'] = 'FAIL';
   }
   if($arr['PASS']=="OK")       
   {    $arr['MSG2'] = "Insert Success";            
   }
   echo json_encode($arr);  
}   
else
{  header("location: ../Error_Fail.php");       
}
?>

如您所见，PHP文件非常长。有一组prepare语句检查表中是否已经存在CC对，然后有另一组语句插入CC对。 从我看到的情况来看，对于每个添加新值对的AJAX请求，mysqli语句都会重新准备。然后再次请求，以此类推。我想这会给服务器带来很多开销和数据，只是为了实现安全性。其他人使用AJAX-POST-PHP开发web应用程序时也是这样吗？在我看来，对于每个prepare，值只能插入一次似乎是不可避免的？如何准备一次这个语句，并且只执行重复执行，因为数据是可用的？我似乎无法理解事先准备好的报表的“效率”因素

谢谢。。如果你能从一些经验丰富的程序员那里得到一些建议，我将不胜感激。

你说：

如您所见，PHP文件非常长

这是真的，但这不是事先准备好的声明的错。您一定是从一个写得很差的教程中学习PHP开发的。这段代码不需要太长。事实上，它可以被严重缩短

只需修复现有代码就可以使其更具可读性。我使用了OOP风格的mysqli，删除了所有这些

if

语句。您应该启用错误报告

<?php

session_start();
if (isset($_POST['CT'],$_POST['CN'])) {
    require_once "golin_2.php";
    $CN = $_POST['CN'];
    $CT = $_POST['CT'];
    $ER = "";
    $arr = [
        'PASS' => "OK",
        'MSG2' => "Insert Success",
    ]; // successful state should be the default outcome

    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
    $CONN = new mysqli($SERVER, $USER, $PASS, $DBNAME);
    $CONN->set_charset('utf8mb4'); // always set the charset

    // To check existance of data in database we use COUNT(*)
    $stmt = $CONN->prepare("SELECT COUNT(*) FROM sailors.continental_regions WHERE CONTINENT = ? AND COUNTRY = ?");
    $stmt->bind_param("ss", $CN, $CT);
    $stmt->execute();
    $NUMROWS = $stmt->get_result()->fetch_row()[0];
        
    if ($NUMROWS) {
        $ER .= "Err: duplicate '$CN' '$CT' pair";
    } else {
        $stmt = $CONN->prepare("INSERT INTO DB.continental_regions (CONTINENT,COUNTRY) values (?, ?)");
        $stmt->bind_param("ss", $CN, $CT);
        $stmt->execute();
    }
            
    if ($ER) {
        $arr = [
            'PASS' => "FAIL",
            'MSG' => $ER,
        ];
    }
    echo json_encode($arr);
} else {
    header("location: ../Error_Fail.php");
}

<?PHP       
session_start();
if( (isset($_POST['CT'])) && (isset($_POST['CN'])))
{ require_once ("golin_2.php");             
  $CN = $_POST['CN'];
  $CT = $_POST['CT'];
  $ER = "";
  $CONN = mysqli_connect($SERVER, $USER, $PASS, $DBNAME);
  If($CONN == FALSE) 
    { $ER = $ER . "Err: Conn Could not connect to Databse ".mysqli_connect_errno().' '.mysqli_connect_error();
    }
    else
    {   $SQL_1 = "SELECT * FROM sailors.continental_regions WHERE CONTINENT = ? AND COUNTRY = ?";   
    if(!($STMT_1 = mysqli_stmt_init($CONN)))
    {   $ER = $ER . "Err: Stmt Prepare Failed";
    }
    else
    {  if(!mysqli_stmt_prepare($STMT_1, $SQL_1))    ///FIRST SET of prepared statement lines
       {   $ER = $ER . "Err: Stmt Prepare Failed";
       }
       else
       {   if(!mysqli_stmt_bind_param($STMT_1,"ss",$CN, $CT))
           {   $ER = $ER . "Err: Stmt Prepare Failed";
        }
        else
        {   if(!(mysqli_stmt_execute($STMT_1)))
            {   $ER = $ER . "Err: Stmt_1 Execute Failed";
            }
            else
            {   $RES_1 = mysqli_stmt_get_result($STMT_1);
            $NUMROWS_1 = mysqli_num_rows($RES_1);
            if($NUMROWS_1>0)
            {  $ER = $ER . "Err: duplicate '$CN' '$CT' pair";
            }
            if($NUMROWS_1==0)
            {  $SQL_2 = "INSERT INTO DB.continental_regions (CONTINENT,COUNTRY) values (?, ?)";                     
               if(!($STMT_2=(mysqli_stmt_init($CONN))))
               {    $ER = $ER . "Err: Init2 failed";    
               }
               else
                   {    if(!mysqli_stmt_prepare($STMT_2, $SQL_2))     ///SECOND SET of prepared statement lines
                {   $ER = $ER . "Err: Prep2 failed".mysqli_error($CONN);    
                }
                else
                {   if(!mysqli_stmt_bind_param($STMT_2,"ss",$CN, $CT))
                    {   $ER = $ER . "Err: Bind2 failed";    
                    }
                    else
                    {   
                    if(!(mysqli_stmt_execute($STMT_2)))
                    {   $ER = $ER . "Err: Exec failed"; 
                    }
                    else
                    {   $arr['PASS'] = 'OK';    
                    }
                   }
                }
                }                                                   
            }
            }
        }
       }
    }
    mysqli_free_result($RES_1);
    mysqli_stmt_close($STMT_1);
    mysqli_stmt_close($STMT_2);
    mysqli_close($CONN);                            
   }        
   if($ER!=="")
   {   $arr['MSG'] = $ER;
       $arr['PASS'] = 'FAIL';
   }
   if($arr['PASS']=="OK")       
   {    $arr['MSG2'] = "Insert Success";            
   }
   echo json_encode($arr);  
}   
else
{  header("location: ../Error_Fail.php");       
}
?>

<?php

session_start();
if (isset($_POST['CT'],$_POST['CN'])) {
    require_once "golin_2.php";
    $CN = $_POST['CN'];
    $CT = $_POST['CT'];
    $ER = "";
    $arr = [
        'PASS' => "OK",
        'MSG2' => "Insert Success",
    ]; // successful state should be the default outcome

    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
    $CONN = new mysqli($SERVER, $USER, $PASS, $DBNAME);
    $CONN->set_charset('utf8mb4'); // always set the charset

    // To check existance of data in database we use COUNT(*)
    $stmt = $CONN->prepare("SELECT COUNT(*) FROM sailors.continental_regions WHERE CONTINENT = ? AND COUNTRY = ?");
    $stmt->bind_param("ss", $CN, $CT);
    $stmt->execute();
    $NUMROWS = $stmt->get_result()->fetch_row()[0];
        
    if ($NUMROWS) {
        $ER .= "Err: duplicate '$CN' '$CT' pair";
    } else {
        $stmt = $CONN->prepare("INSERT INTO DB.continental_regions (CONTINENT,COUNTRY) values (?, ?)");
        $stmt->bind_param("ss", $CN, $CT);
        $stmt->execute();
    }
            
    if ($ER) {
        $arr = [
            'PASS' => "FAIL",
            'MSG' => $ER,
        ];
    }
    echo json_encode($arr);
} else {
    header("location: ../Error_Fail.php");
}

<?php

define('DUPLICATE_KEY', 1062);
session_start();
if (isset($_POST['CT'],$_POST['CN'])) {
    require_once "golin_2.php";
    $CN = $_POST['CN'];
    $CT = $_POST['CT'];
    $arr = [
        'PASS' => "OK",
        'MSG2' => "Insert Success",
    ]; // successful state should be the default outcome

    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
    $CONN = new mysqli($SERVER, $USER, $PASS, $DBNAME);
    $CONN->set_charset('utf8mb4'); // always set the charset

    try {
        $stmt = $CONN->prepare("INSERT INTO continental_regions (CONTINENT,COUNTRY) values (?, ?)");
        $stmt->bind_param("ss", $CN, $CT);
        $stmt->execute();
    } catch (mysqli_sql_exception $e) {
        if ($e->getCode() !== DUPLICATE_KEY) {
            // if it failed for any other reason than duplicate key rethrow the exception
            throw $e;
        }
        // if SQL failed due to duplicate entry then set the error message
        $arr = [
            'PASS' => "FAIL",
            'MSG' => "Err: duplicate '$CN' '$CT' pair",
        ];
    }
    
    echo json_encode($arr);
} else {
    header("location: ../Error_Fail.php");
}