PHP中的參數化MySQL作爲函數

Question

我正在着手完全重寫一箇舊網站，我管理和利用這個機會盡可能多地做好最佳實踐/整理代碼。考慮到這一點，我非常希望將數據庫調用從頁面渲染代碼移出，並將其轉換爲可以重用的常用函數庫 - 一個準MVC模型，如果您願意的話。然而，重寫的目標之一是儘可能保持安全性，並且我懷疑用參數化/參數化查詢來實現這一目標的最佳方法。

因此，假設我的代碼想要回來的通常是一個記錄集數組，有沒有一種方法可以編寫一個足夠靈活的函數來處理各種傳入的SQL查詢，但仍然被參數化？

Answer 1

使用這個由我寫的類。樂於助人的

class Database { 

public $hostname, $dbname, $username, $password, $conn; 

function __construct() { 
    $this->host_name = "HOST_NAME"; 
    $this->dbname = "DBNAME"; 
    $this->username = "USERNAME"; 
    $this->password = "PASSWORD"; 
    try { 

     $this->conn = new PDO("mysql:host=$this->host_name;dbname=$this->dbname", $this->username, $this->password); 
     $this->conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 
    } catch (PDOException $e) { 
     echo 'Error: ' . $e->getMessage(); 
    } 
} 

function customSelect($sql) { 
    try { 
     $stmt = $this->conn->prepare($sql); 
     $result = $stmt->execute(); 
     $rows = $stmt->fetchAll(); // assuming $result == true 
     return $rows; 
    } catch (PDOException $e) { 
     echo 'Error: ' . $e->getMessage(); 
    } 
} 

function select($tbl, $cond='') { 
    $sql = "SELECT * FROM $tbl"; 
    if ($cond!='') { 
     $sql .= " WHERE $cond "; 
    } 

    try { 
     $stmt = $this->conn->prepare($sql); 
     $result = $stmt->execute(); 
     $rows = $stmt->fetchAll(); // assuming $result == true 
     return $rows; 
    } catch (PDOException $e) { 
     echo 'Error: ' . $e->getMessage(); 
    } 
} 
function num_rows($rows){ 
    $n = count($rows); 
    return $n; 
} 

function delete($tbl, $cond='') { 
    $sql = "DELETE FROM `$tbl`"; 
    if ($cond!='') { 
     $sql .= " WHERE $cond "; 
    } 

    try { 
     $stmt = $this->conn->prepare($sql); 
     $stmt->execute(); 
     return $stmt->rowCount(); // 1 
    } catch (PDOException $e) { 
     return 'Error: ' . $e->getMessage(); 
    } 
} 

function insert($tbl, $arr) { 
    $sql = "INSERT INTO $tbl (`"; 
    $key = array_keys($arr); 
    $val = array_values($arr); 
    $sql .= implode("`, `", $key); 
    $sql .= "`) VALUES ('"; 
    $sql .= implode("', '", $val); 
    $sql .= "')"; 

    $sql1="SELECT MAX(id) FROM `$tbl`"; 
    try { 

     $stmt = $this->conn->prepare($sql); 
     $stmt->execute(); 
     $stmt2 = $this->conn->prepare($sql1); 
     $stmt2->execute(); 
     $rows = $stmt2->fetchAll(); // assuming $result == true 
     return $rows[0][0]; 
    } catch (PDOException $e) { 
     return 'Error: ' . $e->getMessage(); 
    } 
} 

function update($tbl, $arr, $cond) { 
    $sql = "UPDATE `$tbl` SET "; 
    $fld = array(); 
    foreach ($arr as $k => $v) { 
     $fld[] = "`$k` = '$v'"; 
    } 
    $sql .= implode(", ", $fld); 
    $sql .= " WHERE " . $cond; 

    try { 
     $stmt = $this->conn->prepare($sql); 
     $stmt->execute(); 
     return $stmt->rowCount(); // 1 
    } catch (PDOException $e) { 
     return 'Error: ' . $e->getMessage(); 
    } 
} 

}

Answer 2

您應該使用PDO。

要進行參數化查詢：

$prep = $db->prepare("SELECT * FROM `users` WHERE userid = :id"); 
$prep->execute(array(":id" => $userid); 

它可以處理所有類型的查詢可能的（INSERT，SELECT，UPDATE語句，包括存儲過程調用）。看看this page