写了一个php程序，希望可以优化运行效率和安全(防注入)，欢迎各种招数飞来？

回复内容：

革命尚未成功，同志仍需努力。很多的代码其实用不到。这段程序完全可以优化的很短。
你看看我之前写的一个DB类。参考一下。都互相学习学习。

我中间的scalar和find方法还有一些问题。请能人帮忙解答一下。还有就是之前的插入，更新，删除都是用的数组，这个让我给成用原生sql了。也可以改成数组。
请帮忙看看，批评指正一下。

<span class="cp"><?php</span>
<span class="sd">/**</span>
<span class="sd"> * MySQL数据库类 使用的是PDO</span>
<span class="sd"> */</span>
<span class="k">class</span> <span class="nc">DB</span><span class="p">{</span>
	<span class="sd">/**</span>
<span class="sd">	 * 数据库实例</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">static</span> <span class="nv">$db_instance</span><span class="p">;</span>

	<span class="sd">/**</span>
<span class="sd">	 * 保存错误消息</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">static</span> <span class="nv">$_error</span><span class="p">;</span>

	<span class="sd">/**</span>
<span class="sd">	 * 禁止复制 为了单例模式</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">function</span> <span class="nf">__clone</span><span class="p">(){}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 防止反序列化 为了单例模式</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">function</span> <span class="nf">__wakeup</span><span class="p">(){}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 防止实例化</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">function</span> <span class="nf">__construct</span><span class="p">(){}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 数据库实例化 这里如果实例化失败会产生一个错误，我没有去进行捕获。</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">getInstance</span><span class="p">(){</span>
		<span class="k">if</span> <span class="p">(</span><span class="k">empty</span><span class="p">(</span><span class="nx">self</span><span class="o">::</span><span class="nv">$db_instance</span><span class="p">))</span> <span class="p">{</span>
			<span class="nv">$config</span> <span class="o">=</span> <span class="nx">Config</span><span class="o">::</span><span class="na">get</span><span class="p">(</span><span class="s1">'db'</span><span class="p">);</span>
			<span class="nx">self</span><span class="o">::</span><span class="nv">$db_instance</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">\PDO</span><span class="p">(</span><span class="s1">'mysql:host='</span><span class="o">.</span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'host'</span><span class="p">]</span> <span class="o">.</span><span class="s1">';dbname='</span> <span class="o">.</span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'database'</span><span class="p">]</span> <span class="o">.</span> <span class="s1">';port='</span> <span class="o">.</span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'port'</span><span class="p">],</span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'username'</span><span class="p">],</span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'password'</span><span class="p">],</span> <span class="k">array</span><span class="p">(</span><span class="nx">\PDO</span><span class="o">::</span><span class="na">MYSQL_ATTR_INIT_COMMAND</span> <span class="o">=></span> <span class="s1">'set names '</span> <span class="o">.</span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'charset'</span><span class="p">],</span> <span class="nx">\PDO</span><span class="o">::</span><span class="na">ATTR_TIMEOUT</span> <span class="o">=></span> <span class="nv">$config</span><span class="p">[</span><span class="s1">'timeout'</span><span class="p">]));</span>
		<span class="p">}</span>
		<span class="k">return</span> <span class="nx">self</span><span class="o">::</span><span class="nv">$db_instance</span><span class="p">;</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 查询标量数据</span>
<span class="sd">	 * @param string $sql 执行的sql语句</span>
<span class="sd">	 * @param string $params 需要替换$sql中的问号 如果没有？,则为空数组</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">scalar</span><span class="p">(</span><span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span> <span class="o">=</span> <span class="p">[]){</span>
		<span class="nv">$data</span> <span class="o">=</span> <span class="nx">self</span><span class="o">::</span><span class="na">selectQuery</span><span class="p">(</span><span class="s1">'scalar'</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">);</span>
		<span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="k">empty</span><span class="p">(</span><span class="nv">$data</span><span class="p">[</span><span class="mi">0</span><span class="p">]))</span> <span class="p">{</span>
			<span class="k">return</span> <span class="nv">$data</span><span class="p">[</span><span class="mi">0</span><span class="p">];</span>
		<span class="p">}</span><span class="k">else</span><span class="p">{</span>
			<span class="k">return</span> <span class="s1">''</span><span class="p">;</span>
		<span class="p">}</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 查询单列数据</span>
<span class="sd">	 * @param string $sql 执行的sql语句</span>
<span class="sd">	 * @param string $params 需要替换$sql中的问号 如果没有？,则为空数组</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">column</span><span class="p">(</span><span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span> <span class="o">=</span> <span class="p">[]){</span>
		<span class="k">return</span> <span class="nx">self</span><span class="o">::</span><span class="na">selectQuery</span><span class="p">(</span><span class="s1">'column'</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">);</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 查询一行记录</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">find</span><span class="p">(</span><span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span> <span class="o">=</span> <span class="p">[]){</span>
		<span class="nv">$result</span> <span class="o">=</span> <span class="nx">self</span><span class="o">::</span><span class="na">selectQuery</span><span class="p">(</span><span class="s1">'find'</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">);</span>
		<span class="k">if</span> <span class="p">(</span><span class="k">empty</span><span class="p">(</span><span class="nv">$result</span><span class="p">[</span><span class="mi">0</span><span class="p">]))</span> <span class="p">{</span>
			<span class="k">return</span> <span class="p">[];</span>
		<span class="p">}</span>
		<span class="k">return</span> <span class="nv">$result</span><span class="p">;</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 查询多行记录</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">all</span><span class="p">(</span><span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span> <span class="o">=</span> <span class="p">[]){</span>
		<span class="k">return</span> <span class="nx">self</span><span class="o">::</span><span class="na">selectQuery</span><span class="p">(</span><span class="s1">'all'</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">);</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 查询数据</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">selectQuery</span><span class="p">(</span><span class="nv">$type</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">){</span>
		<span class="nx">self</span><span class="o">::</span><span class="na">getInstance</span><span class="p">();</span>
		<span class="nv">$instanceStatement</span> <span class="o">=</span> <span class="nx">self</span><span class="o">::</span><span class="nv">$db_instance</span><span class="o">-></span><span class="na">prepare</span><span class="p">(</span><span class="nv">$sql</span><span class="p">);</span>
		<span class="nv">$result</span> <span class="o">=</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">execute</span><span class="p">(</span><span class="nv">$params</span><span class="p">);</span>
		<span class="k">if</span> <span class="p">(</span><span class="nv">$result</span> <span class="o">===</span> <span class="k">false</span><span class="p">)</span> <span class="p">{</span>
			<span class="nx">self</span><span class="o">::</span><span class="nv">$_error</span> <span class="o">=</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">errorInfo</span><span class="p">();</span>
			<span class="k">return</span> <span class="k">false</span><span class="p">;</span>
		<span class="p">}</span><span class="k">else</span><span class="p">{</span>
			<span class="nx">self</span><span class="o">::</span><span class="nv">$_error</span> <span class="o">=</span> <span class="k">null</span><span class="p">;</span>
			<span class="k">switch</span> <span class="p">(</span><span class="nv">$type</span><span class="p">)</span> <span class="p">{</span>
				<span class="k">case</span> <span class="s1">'column'</span><span class="o">:</span> <span class="c1">//获取指定的一列数据</span>
				<span class="k">case</span> <span class="s1">'scalar'</span><span class="o">:</span> <span class="k">return</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">fetchAll</span><span class="p">(</span><span class="nx">\PDO</span><span class="o">::</span><span class="na">FETCH_COLUMN</span><span class="p">);</span> <span class="k">break</span><span class="p">;</span> <span class="c1">//获取指定的一行数据</span>
				<span class="k">case</span> <span class="s1">'find'</span><span class="o">:</span> <span class="c1">//获取执行的一行数据</span>
				<span class="k">case</span> <span class="s1">'all'</span><span class="o">:</span> <span class="c1">//获取全部数据</span>
				<span class="k">default</span><span class="o">:</span> <span class="k">return</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">fetchAll</span><span class="p">(</span><span class="nx">\PDO</span><span class="o">::</span><span class="na">FETCH_ASSOC</span><span class="p">);</span>
					<span class="k">break</span><span class="p">;</span>
			<span class="p">}</span>
		<span class="p">}</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 插入单行数据数据</span>
<span class="sd">	 * @param string $sql 执行的sql语句</span>
<span class="sd">	 * @param array $params 需要插入的参数;</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">function</span> <span class="nf">insert</span><span class="p">(</span><span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span> <span class="o">=</span> <span class="p">[]){</span>
		<span class="k">return</span> <span class="nx">self</span><span class="o">::</span><span class="na">executeQuery</span><span class="p">(</span><span class="s1">'insert'</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">);</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 更新数据</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">function</span> <span class="nf">update</span><span class="p">(</span><span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span> <span class="o">=</span> <span class="p">[]){</span>
		<span class="k">return</span> <span class="nx">self</span><span class="o">::</span><span class="na">executeQuery</span><span class="p">(</span><span class="s1">'update'</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">);</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 更新数据数据 </span>
<span class="sd">	 * @param string $type insert update delete</span>
<span class="sd">	 * @param string $sql 执行的sql语句</span>
<span class="sd">	 * @param array $params 需要替换?的数据 格式[field1, field2, ...];</span>
<span class="sd">	 */</span>
	<span class="k">private</span> <span class="k">function</span> <span class="nf">executeQuery</span><span class="p">(</span><span class="nv">$type</span><span class="p">,</span> <span class="nv">$sql</span><span class="p">,</span> <span class="nv">$params</span><span class="p">){</span>
		<span class="nx">self</span><span class="o">::</span><span class="na">getInstance</span><span class="p">();</span>
		<span class="c1">//初始化</span>
		<span class="nv">$instanceStatement</span> <span class="o">=</span> <span class="nx">self</span><span class="o">::</span><span class="nv">$db_instance</span><span class="o">-></span><span class="na">prepare</span><span class="p">(</span><span class="nv">$sql</span><span class="p">);</span>
		<span class="nv">$result</span> <span class="o">=</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">execute</span><span class="p">(</span><span class="nv">$params</span><span class="p">);</span>
		<span class="k">if</span> <span class="p">(</span><span class="nv">$result</span> <span class="o">===</span> <span class="k">false</span><span class="p">)</span> <span class="p">{</span>
			<span class="nv">$this</span><span class="o">-></span><span class="na">_error</span> <span class="o">=</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">errorInfo</span><span class="p">();</span>
			<span class="k">return</span> <span class="k">false</span><span class="p">;</span>
		<span class="p">}</span><span class="k">else</span><span class="p">{</span>
			<span class="nv">$this</span><span class="o">-></span><span class="na">_error</span> <span class="o">=</span> <span class="s1">''</span><span class="p">;</span> <span class="c1">//清除上次的错误信息</span>
			<span class="k">if</span> <span class="p">(</span><span class="nv">$type</span> <span class="o">==</span> <span class="s1">'insert'</span><span class="p">)</span> <span class="p">{</span>
				<span class="k">return</span> <span class="nv">$this</span><span class="o">-></span><span class="na">db</span><span class="o">-></span><span class="na">lastInsertId</span><span class="p">()</span> <span class="o">+</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">rowCount</span><span class="p">()</span> <span class="o">-</span> <span class="mi">1</span><span class="p">;</span> <span class="c1">//测试性质 （不一定正确，风险极高）</span>
			<span class="p">}</span><span class="k">else</span><span class="p">{</span>
				<span class="k">return</span> <span class="nv">$instanceStatement</span><span class="o">-></span><span class="na">rowCount</span><span class="p">();</span>
			<span class="p">}</span>
		<span class="p">}</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 获取错误消息</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">error</span><span class="p">(){</span>
		<span class="k">return</span> <span class="nx">self</span><span class="o">::</span><span class="nv">$_error</span><span class="p">;</span>
	<span class="p">}</span>

	<span class="sd">/**</span>
<span class="sd">	 * 消除实例</span>
<span class="sd">	 */</span>
	<span class="k">public</span> <span class="k">static</span> <span class="k">function</span> <span class="nf">clear</span><span class="p">(){</span>
		<span class="nx">self</span><span class="o">::</span><span class="nv">$db_instance</span> <span class="o">=</span> <span class="k">null</span><span class="p">;</span>
	<span class="p">}</span>
<span class="p">}</span>
<span class="cp">?></span><span class="x"></span>

那我不客气了。

从头到尾都是辣鸡。

好大一个洞，随时被人爆。用 prepared statement 吧兄弟

->arrays() 这个方法从命名到实现都很 orz ，别人在调用这个方法的时候心情大概跟吃了大便差不多。

连接方法没有处理好重入， 导致 conn 对象重复创建也是醉。

参数初始化放到构造函数里去啊，依赖全局变量什么鬼。

类名丑爆。

<span class="x">$this->result = mysql_query("$query",$this->conn);  </span>

建议题主去看看Yii framework或者laravel它们的数据库封装是怎么做的，你写的这些方法只能认为是来黑php的 好多多余的代码

Artikel sebelumnya：如何说服我的老师使用较新的语言？ Artikel seterusnya：PHP 使用 Mysqli 的 prepare 语句有什么好处？

Kenyataan Laman Web ini

Kandungan artikel ini disumbangkan secara sukarela oleh netizen, dan hak cipta adalah milik pengarang asal. Laman web ini tidak memikul tanggungjawab undang-undang yang sepadan. Jika anda menemui sebarang kandungan yang disyaki plagiarisme atau pelanggaran, sila hubungi admin@php.cn

Artikel terbaru oleh pengarang

• Apakah itu NullPointerException, dan bagaimana saya membetulkannya?
  2024-10-22 09:46:29
• Daripada Novis kepada Coder: Perjalanan Anda Bermula dengan Asas C
  2024-10-13 13:53:41
• Membuka Kunci Pembangunan Web dengan PHP: Panduan Pemula
  2024-10-12 12:15:51
• Demystifying C: Laluan Yang Jelas dan Mudah untuk Pengaturcara Baharu
  2024-10-11 22:47:31
• Buka Potensi Pengekodan Anda: Pengaturcaraan C untuk Pemula Mutlak
  2024-10-11 19:36:51
• Lepaskan Pengaturcara Dalaman Anda: C untuk Pemula Mutlak
  2024-10-11 15:50:41
• Automasi Kehidupan Anda dengan C: Skrip dan Alat untuk Pemula
  2024-10-11 15:07:41
• PHP Dipermudahkan: Langkah Pertama Anda dalam Pembangunan Web
  2024-10-11 14:21:21
• Bina Apa sahaja dengan Python: Panduan Pemula untuk Melancarkan Kreativiti Anda
  2024-10-11 12:59:11
• Kunci Pengekodan: Membuka Kunci Kuasa Python untuk Pemula
  2024-10-11 12:17:31

Isu terkini

function_exists() tidak boleh menentukan fungsi tersuai Ujian fungsi () {return true;} jika (function_exists ('test')) {echo "test is functio...

daripada 2024-04-29 11:01:01

0

3

2720

Bagaimana untuk memaparkan versi mudah alih Google Chrome Hello cikgu, bagaimana saya boleh menukar Google Chrome kepada versi mudah alih?

daripada 2024-04-23 00:22:19

0

11

2843

Tetingkap anak mengendalikan tetingkap induk, tetapi output tidak bertindak balas. Dua ayat pertama boleh dilaksanakan, tetapi ayat terakhir tidak boleh dilaksanakan.

daripada 2024-04-19 15:37:47

0

1

2394

Tiada output dalam tetingkap induk document.onclick = function(){ window.opener.document.write('Saya adalah output tetingkap ...

daripada 2024-04-18 23:52:34

0

1

2293

Di manakah perisian kursus tentang pemetaan minda CSS? Perisian kursus

daripada 2024-04-16 10:10:18

0

0

2369

Topik-topik yang berkaitan

Lagi>

• Bagaimana untuk memasukkan keistimewaan root dalam linux
• Apakah maksud topeng ps?
• Peranan fungsi pengesahan
• win10 menyambung ke pencetak kongsi
• Bagaimana untuk menyelesaikan ralat http 503
• Cara menyediakan Douyin untuk menghalang semua orang daripada melihat hasil kerja
• Bagaimana untuk berdagang mata wang maya
• Apakah pernyataan untuk memadam jadual dalam sql