如何从简单的 mysqli 查询更改为准备好的语句？

Question

我做了 3 次查询（SELECT、INSERT、UPDATE）它有效，但在当前状态下看起来很难看而且不安全。

有什么方法可以使这些 SELECT、INSERT、UPDATE 查询比准备好的语句更具可读性和安全性？

    $email = $_SESSION['email'];
    $query = "SELECT username FROM users WHERE email='$email'";
    $result = mysqli_query($connect, $query);
    $row = mysqli_fetch_assoc($result);
    $username = $row['username'];

    if(!empty($_POST["comment"])){
    $id = $_GET['id'];
    $sql = "INSERT INTO user_comments (parent_id, comment, username, custom_id) VALUES ('".$_POST["commentID"]."', '".$_POST["comment"]."', '$username', '$id')";
    mysqli_query($connect, $sql) or die("ERROR: ". mysqli_error($connect));

    /// I need this update query to make every inserted comment's ID +1 or can I do this more simple?
    $sql1 = "UPDATE user_comments SET id = id +1 WHERE custom_id = '$id'";
    mysqli_query($connect, $sql1) or die("ERROR: ". mysqli_error($connect));

Answer 1

试一试。您可以使用 $ex->insert_id 来获取 last entered ID. This may come in handy when mass inserting into a DB. I generally use PDO，因为我发现代码看起来更清晰，但我认为这完全是我的偏好。请记住 ->bind_param 行，"isii" 指的是您输入的数据类型。所以，在这种情况下，它是 Integer, String, Integer, Integer（我可能弄错了）。

$email    = $_SESSION['email'];
$query    = "SELECT username FROM users WHERE email='$email'";
$result   = mysqli_query($connect, $query);
$row      = mysqli_fetch_assoc($result);
$username = $row['username'];

if(!empty($_POST["comment"])){
$id        = $_GET['id'];
$commentID = $_POST["commentID"];
$comment   = $_POST["comment"];

$sql = "INSERT INTO user_comments (parent_id, comment, username, custom_id) VALUES (?, ?, ?, ?)";
$ex  = $connect->prepare($sql);
$ex->bind_param("isii", $commentID, $comment, $username, $id);

if($ex->execute()){
    // query success
    // I need this update query to make every inserted comment's ID +1 or can I do this more simple?

    $lastInsertID = $ex->insert_id;

    $sql1 = "UPDATE user_comments SET id = id + 1 WHERE custom_id = ?";
    $ex1  = $connect->prepare($sql1);
    $ex1->bind_param("i",$lastInsertID);
    if($ex1->execute()){
        // query success
    }else{
        // query failed
        error_log($connect->error);
    }
}else{
    //query failed
    error_log($connect->error);
}

如何从简单的 mysqli 查询更改为准备好的语句？

How to change from simple mysqli query to prepared statement?

php

mysqli

prepared-statement