問(wèn)題描述

我目前使用已棄用的代碼從用戶(hù)那里獲取數(shù)據(jù)，如下所示:

I'm currently using deprecated code to get data from users, as follows:

/* retrieve */
$lastName = $_POST['lastName']; 
$firstName = $_POST['firstName']; 
$examLevel=$_POST['level'];

/* connect */
$dbc=mysql_connect("localhost", "user", "passw") or die('Error connecting to MySQL server');
mysql_select_db("db") or die('Error selecting database.');

/* sanitize */
$lastName=mysql_real_escape_string($lastName);
$firstName=mysql_real_escape_string($firstName); 
$examLevel=mysql_real_escape_string($examLevel);


/* insert */
$query_personal = "INSERT INTO personal (LastName, FirstName) VALUES  ('$lastName', '$firstName')";

$query_exam = "INSERT INTO exam (Level, Centre, BackupCentre, etc.) VALUES ('$examLevel', '$centre', '$backup', 'etc')";

這是有效的，但我不斷收到有關(guān)安全性和缺乏支持的警告.使用 mysqli 而不是 mysql connect 有一個(gè)小的重寫(xiě)，但是 mysqli_real_escape_string 怎么樣?我已經(jīng)在示例中看到了它，但我也看到了使用準(zhǔn)備好的語(yǔ)句而不是不使用 mysqli_real_escape_string 的建議.

This is working but I keep coming across warnings about security and lack of support. There's a small rewrite to connect with mysqli instead of mysql but what about mysqli_real_escape_string? I've seen it used in examples but I've also seen advice to use prepared statements instead which don't use mysqli_real_escape_string.

我將如何使用準(zhǔn)備好的語(yǔ)句來(lái)插入我的數(shù)據(jù)?到目前為止，我對(duì)此有點(diǎn)茫然.比如參數(shù)綁定只針對(duì)INSERT，結(jié)果綁定只針對(duì)SELECT?

And how would I use prepared statements to INSERT my data? I'm a bit at sea with this bit so far. For example, is parameter binding only for INSERTs and result binding only for SELECTs?

推薦答案

將其轉(zhuǎn)換為 PDO

/* connect */
$dsn = "mysql:host=localhost;db=test;charset=utf8";
$opt = array(
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
);
$pdo = new PDO($dsn,"user", "passw", $opt);


/* insert */
$query = "INSERT INTO personal (LastName, FirstName) VALUES  (?, ?)";
$stmt  = $pdo->prepare($query);
$stmt->execute(array($_POST['lastName'],$_POST['firstName']));

$query = "INSERT INTO exam (Level, Centre, BackupCentre, etc) VALUES (?, ?, ?, 'etc')";
$stmt  = $pdo->prepare($query);
$stmt->execute(array($_POST['level'], $centre, $backup));

這篇關(guān)于如何從 mysql_* 升級(jí)到 mysqli_*?的文章就介紹到這了，希望我們推薦的答案對(duì)大家有所幫助，也希望大家多多支持html5模板網(wǎng)！