php - 如何进行参数化查询

Question

[状态:学习者]

我正在尝试实现参数化查询，但我遇到了问题。 Jonathan Sampson 最近暗示了如何做到这一点 (#2286115)，但我没有正确地遵循他的建议。这是我的脚本

$cGrade = "grade" ;

include_once ( "db_login.php" ) ;

$sql = "SELECT   last_name   AS last_name
               , first_name  AS first_name
               , grade       AS gr
               , ethnic      AS eth
               , sex         AS sex
               , student_id  AS id_num
               , reason      AS reason
               , mon_init    AS since
          FROM t_tims0809
         WHERE tag <> '' AND 
               tag IS NOT NULL AND
               schcode = {$schcode}
         ORDER
            BY ('%s') " ;

$qResult = mysql_query ( sprintf ( $sql, $cGrade ) or ( "Error: " . mysql_error() ) ) ;

查询在 ORDER BY 短语中使用 grade 时效果很好。

谢谢。

Answer 1

查看 MySQLi prepared statements类:

$query = "INSERT INTO myCity (Name, CountryCode, District) VALUES (?,?,?)";
$stmt = $mysqli->prepare($query);

$stmt->bind_param("sss", $val1, $val2, $val3);

$val1 = 'Stuttgart';
$val2 = 'DEU';
$val3 = 'Baden-Wuerttemberg';

/* Execute the statement */
$stmt->execute();

来自 PHP 手册。

我觉得这是执行参数化查询的一种更好的方法，我已尽可能切换到准备好的语句，尤其是在批量插入/选择期间。