PHP MySQLi准备/绑定where子句

Question

I try to use mysqli::prepare() for savety reasons, but if I try to prepare the where-clause with "?" mysqli::bind_params() fails (without any errors):

Call to the query function:

$messages = query('SELECT * FROM messages WHERE (receiverID=? AND receiverType=?) OR (senderID=? AND senderType=?) ORDER BY date DESC', false, '', (int)$_SESSION['ID'], (string)$_SESSION['mode'][0], (int)$_SESSION['ID'], (string)$_SESSION['mode'][0]);

Query function:

function query($sql, $fetch, $error, ...$values) {
    global $language; //get translations
    global $mysqli; //get database
    $returnResult = (strtolower(substr(trim($sql), 0, 6)) === 'select'); //check for select ---> retrun result
    if(!empty($error)) $error .= '\n'; //next line after error message (styling / readability)
    $stmt = $mysqli->prepare($sql) or back($error.$language['mysqliErrorPrepare'].$stmt->error); //prepare
    foreach($values as $value) { //go through all params
        $stmt->bind_param((is_string($value)?'s':(is_float($value)?'d':(is_int($value)?'i':'b'))), $value) or back($error.$language['mysqliErrorBind'].$stmt->error); //bind param
    }
    $stmt->execute() or back($error.$language['mysqliErrorExecute'].$stmt->error); //execute
    if($returnResult) $result = $stmt->get_result() or back($error.$language['mysqliErrorGetResult'].$mysqli->error); //get result if necessary
    $stmt->close(); //close
    if($returnResult AND $fetch) $result = $result->fetch_assoc()or back($error.$language['mysqliErrorFetch'].$mysqli->error); //fetch if required
    return ($returnResult?$result:true); //return result / true
}

Questions:

• Why does it fail?
• Can I prepare the where-clause?

Thank you! - Minding

Answer 1

Isn't it because it's not being called by any active database?

Try $db->query(); as below:

$messages = $db->query('SELECT * FROM messages WHERE (receiverID=? AND receiverType=?) OR (senderID=? AND senderType=?) ORDER BY date DESC', false, '', (int)$_SESSION['ID'], (string)$_SESSION['mode'][0], (int)$_SESSION['ID'], (string)$_SESSION['mode'][0]);

Answer 2

The reason this didn't work is that I tried to bind the parameter one-by-one , while mysqli::bind_param() expects to receive all parameters at once . Because of this MySQL only has one parameter, but 4 question marks to work with, which obviously results in an error.

The "right" way to bind multiple parameters dynamically would be this:

if(count($paramValues) > 0) {
    $paramTypes = '';
    $paramBindValues = [&$paramTypes];
    foreach(new RecursiveIteratorIterator(new RecursiveArrayIterator($paramValues), RecursiveIteratorIterator::LEAVES_ONLY) as $paramValue) {
        $paramTypes .= (is_string($paramValue)?'s':(is_float($paramValue)?'d':(is_int($paramValue)?'i':'b')));
        $paramBindValues[] = &$paramValue;
        unset($paramValue);
    }
    if(!$stmt->bind_param(...$paramBindValues))
        throw new Error($sql);
}

But please note, that this also defeats the reusablility of prepared statements and therefore propably has sub-optimal performance.

An example:

foreach($users as $user) {
   //This prepares the statement everytime.
   $info = query('SELECT info FROM users WHERE ID=?', true, '', $user['ID']);
}

//This only prepares the statement once.
$stmt = $mysqli->prepare('SELECT info FROM users WHERE ID=?');
foreach($users as $user) {
    $stmt->bind_params('i', $user['ID']);
    $stmt->execute();
    $info = $stmt->get_result()->fetch_assoc();
}
$stmt->close();

Thanks to @Sean for pointing out that mysqli::bind_params() takes in all parameters at once and providing an example.

Hope this helps. -Minding