This article mainly introduces the preprocessing prepare for operating mysqli in PHP. It has a certain reference value. Now I share it with you. Friends in need can refer to it.

Operation mysqli in PHP Preprocessing prepare

1. [PHP error] Cannot pass parameter 2 by reference

This error means that the second parameter cannot be passed by reference
The reason for this error is bind_param Except for the first parameter that represents the data type, the () method requires the use of variables instead of direct quantities, because other parameters are passed by reference

$sql = "select * from tmp where myname=? or sex =?";
$stmt = $mysqli->conn->prepare($sql);
$name ="a";
$sex="b";
$stmt->bind_param('ss',$name,$sex);//必须要这样传参，且在mysqli等的预处理参数绑定中，必须要指定参数的类型且只能一次性绑定全部参数，不能像PDO那样一个个绑定

//$stmt->bind_param('ss',"a","b");
//这种方式的会报错：Fatal error: Cannot pass parameter 2 by reference$stmt->execute();
if($mysqli->conn->affected_rows){    
$result = $stmt->get_result();    
while($row = $result->fetch_assoc()){        
var_dump($row);
    }
}

2 , To prevent SQL injection in PHP, don’t use addslashes and mysql_real_escape_string anymore

Whether you use addslashes or mysql_real_escape_string, you can use coding vulnerabilities to log in to the server by entering any password. Injection attack! ! ! ! (I won’t go into details about the principle of the attack. Interested students can study the single-byte and multi-byte issues in character encoding)

　The reason why mysql_real_escape_string can prevent injection is because mysql_escape_string itself cannot determine the current encoding. You must specify the server encoding and the client encoding at the same time. This can prevent the injection of encoding problems. Although SQL injection can be prevented to a certain extent, the following perfect solution is still recommended.

$pdo = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'pass');
 
$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');
$stmt->execute(array('name' => $name));
 
foreach ($stmt as $row) {
// do something with $row

Copy after login

MYSQLI:

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);
 
$stmt->execute();
 
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
// do something with $row
}

Copy after login

Copy after login

PDO：

$pdo = new PDO('mysql:dbname=dbtest;host=127.0.0.1;charset=utf8', 'user', 'pass');

$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);


$stmt = $pdo->prepare('SELECT * FROM employees WHERE name = :name');


$stmt->execute(array('name' => $name));

 


foreach ($stmt as $row) {


// do something with $row


}

MYSQLi：

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name);
 
$stmt->execute();
 
$result = $stmt->get_result();
while ($row = $result->fetch_assoc()) {
// do something with $row
}

The reason for this error is that except for the first parameter representing the data type in the bind_param() method,
all need to use variables instead of direct quantities, because other parameters are by reference. The above is the entire content of this article. I hope it will be helpful to everyone's study. For more related content, please pay attention to the PHP Chinese website!

How PHP determines whether a link is valid

Interaction between PHP and Web pages

The above is the detailed content of Preprocessing of mysqli in PHP prepare. For more information, please follow other related articles on the PHP Chinese website!