我第一次准备的 MySQLi 的问题

Question

根据之前关于清理字符串的问题，我现在尝试使用 How can I prevent SQL injection in PHP?

中看到的原则

$connection = mysqli_connect('localhost', 'user', 'xxxxx');
$database = mysqli_select_db($connection, 'xxxxx');

$param1 = $_GET['q'];

//prepared mysqli statement
$stmt = mysqli_stmt_init($connection);    
$stmt = $connection->prepare('SELECT * FROM CONTACTS WHERE SURNAME = ?');
$stmt->bind_param('s', $param1); // 's' specifies the variable type => 'string'

$stmt->execute();
$result = $stmt->get_result();
$num_rows = mysqli_num_rows($result);

echo "Records Found:".$num_rows."<br/><br/><hr/>";

while ($row = $result->fetch_assoc()) {
   echo $result['COMPANY']." ".$result['FORENAME']." ".$result['SURNAME'];
}

然而，虽然 $connection 和 $database 都在正确处理，但我收到以下错误：

Fatal error: Call to undefined method mysqli_stmt::get_result() in /my_first_mysqli.php on line xxxx

我是不是语法不正确，还是与我正在摇摆的 php 5.2.0 版本有更多关系。（是的，我在升级服务器之前先升级代码）。

如果是后者，在我升级 php 版本之前，是否可以使用更简单的 MySQLi 方法？

编辑

我现在更新了这个，它更干净了：

 $servername = "localhost"; $username = "xxxx"; $password = "xxxx"; $dbname = "xxxx";

 // Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

 // Check connection
 if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

$param1 = $_GET['q'];

$stmt = mysqli_prepare($conn, "SELECT CONTACTID, COMPANY, FORENAME, SURNAME FROM CONTACTS WHERE SURNAME = ?");

/* bind parameters for markers */
mysqli_stmt_bind_param($stmt, "s", $param1);

/* execute query */
mysqli_stmt_execute($stmt);

/* bind result variables */
mysqli_stmt_bind_result($stmt, $CONTACTID, $COMPANY, $FORENAME, $SURNAME);

/* fetch value */
mysqli_stmt_fetch($stmt);

$num_rows = mysqli_num_rows($stmt);
echo "Records Found:".$num_rows."<br/><br/><hr/>";


/* close statement */
mysqli_stmt_close($stmt);


mysqli_close ($conn);

我显然没有得到要循环的记录集结果，也不知道如何...其余的似乎可以正常工作而不会引发错误。

Answer 1

感谢所有贡献。我现在有一个可行的程序解决方案，我想 post 以供参考。

有点麻烦，但很好，我相信它遵循了良好的现代实践。

$servername = "localhost"; $username = "xxxx"; $password = "xxxx"; $dbname = "xxxx";
$conn = new mysqli($servername, $username, $password, $dbname);// Create connection

// Check connection
if ($conn->connect_error) {
   die("Connection failed: " . $conn->connect_error);
}

$param1 = $_GET['q'];

$stmt = mysqli_prepare($conn, "SELECT CONTACTID, COMPANY, FORENAME, SURNAME FROM CONTACTS WHERE SURNAME = ?");
mysqli_stmt_bind_param($stmt, "s", $param1);// bind parameters for markers
mysqli_stmt_execute($stmt);// execute query
mysqli_stmt_bind_result($stmt, $CONTACTID, $COMPANY, $FORENAME, $SURNAME);// bind result variables

// fetch values
while (mysqli_stmt_fetch($stmt)) {
   echo $CONTACTID."<br>";
   echo $COMPANY."<br>";
   echo $FORENAME."<br>";
   echo $SURNAME."<br>";
   echo "<hr/>";
}

mysqli_stmt_close($stmt);// close statement

mysqli_close ($conn);

如果您看到任何改进，欢迎提供反馈。

我第一次准备的 MySQLi 的问题

Problems with my first prepared MySQLi

php

mysqli

prepared-statement