Pete FreitagPrepared Statements in PHP and MySQL
By Pete Freitag
I'm working on a web security presentation, and I was curious to know if PHP supported prepared statements. It looks like as of PHP 5 they do support it with the new mysqli object (mysqli replaces the mysql class with support for mysql 4.x features)
Here's how you do a prepared statement with php 5 and mysql (error checking is omitted):
$db_connection = new mysqli("localhost", "user", "pass", "db");
$statement = $db_connection->prepare("SELECT thing FROM stuff WHERE id = ?");
$statement->bind_param("i", $id);
$statement->execute();
...
The first argument of bind_param is the type, in this case I used i for integer - you can also use s for string, d for double, and b for blob.
The variables in your query are represented with the ? question marks, just like with JDBC. This makes maintenance kind of a pain, it makes you appreciate CFML's prepared statement implementation with cfqueryparam.
You can also use PEAR:DB to run prepared statements in PHP, since it is a database abstraction layer, it is probably a good way to go.
MySQL supports prepared statements in version 4.1 and above.
Prepared Statements in PHP and MySQL was first published on May 16, 2005.
If you like reading about php, mysql, prepared statements, cfqueryparam, or mysqli then you might also like:
Discuss / Follow me on Twitter ↯
Tweet Follow @pfreitagComments
dynamicaly a table name in a procedure. the sample coding is given bellow.
create procedure table_name(x varchar(100))
begin
select * from x;
end;|
call table_name('books');
It shows an error message table x doesnot existt
Any one can help me how to solve this problem
$prefix = 'W'; // a universal prefix prefix
$my_random_id = $prefix;
$my_random_id .= chr(rand(65,90));
$my_random_id .= time();
$my_random_id .= $prefix;
i had used this coding
and msql query as
print $my_random_id;
$qurey="INSERT INTO FeedBackDetails (Name,Age,DateOfBirth,Gender,Adress,PhoneNo,MobileNo,Email,Profession,Comments,CustomerId)
VALUES
('$_POST[name]','$_POST[age]','$_POST[date]','$_POST[gender]','$_POST[adress]','$_POST[phone]','$_POST[mobile]','$_POST[mail]','$_POST[profession]','$_POST[comments]','$_POST[my_random_id]')";