What does php preprocessing mean?

Many more mature databases support the concept of prepared statements. What is a prepared statement? Think of it as a compiled template of the SQL you want to run, which can be customized using variable parameters.

Preprocessing statements can bring two major benefits:

Query It only needs to be parsed (or preprocessed) once, but can be executed multiple times with the same or different parameters. When the query is ready, the database will analyze, compile and optimize the plan to execute the query. (Recommended learning: PHP video tutorial)

For complex queries, this process will take a long time. If the same query needs to be repeated multiple times with different parameters, then the process will Significantly slows down the application. By using prepared statements, you can avoid repeated analysis/compile/optimization cycles. Simply put, prepared statements use fewer resources and therefore run faster.

Parameters provided to prepared statements do not need to be enclosed in quotes, the driver will handle them automatically. If the application only uses prepared statements, it can be ensured that SQL injection will not occur. (However, if other parts of the query are constructed from unescaped input, there is still a risk of SQL injection).

Prepared statements are so useful that their only feature is that PDO will simulate processing when the driver does not support it. This ensures that applications can use the same data access pattern regardless of whether the database has such capabilities.

Use prepared statements to obtain data

The following example obtains data based on the key value provided. User input is automatically quoted, so there is no danger of SQL injection attacks.

<?php
$stmt = $dbh->prepare("SELECT * FROM REGISTRY where name = ?");
if ($stmt->execute(array($_GET[&#39;name&#39;]))) {
  while ($row = $stmt->fetch()) {
    print_r($row);
  }
}
?>

If the database driver supports it, the application can also bind output and input parameters. Output parameters are usually used to obtain values ​​from stored procedures. Output parameters are slightly more complicated to use than input parameters because when binding an output parameter, you must know the length of the given parameter. If the value bound to a parameter is greater than the recommended length, an error is generated.

The above is the detailed content of What does php preprocessing mean?. For more information, please follow other related articles on the PHP Chinese website!