Mysqli多查询的PHP程序准备语句

Question

I have a PHP code that opens a CSV file using fgetcsv then reads through each rows then constructs a "Insert Into" query and attaches it to a variable named $MyQuery . This is the most understandable way for me when trying to update my database using information from a CSV file downloaded from the company website. This is working as I expected using the code below:

if (mysqli_multi_query($conn, $MyQuery))
{
    do
    {
        /* store first result set */
        if ($result = mysqli_store_result($conn))
        {
                    mysqli_free_result($result);
        }
    } while (mysqli_next_result($conn));
}

Recently I learned about Prepared Statements and how they can secure your queries.

PROBLEM: How can I do multiquery with prepared statement in Procedural Mysqli way? I tried researching, a lot says it isn't possible. Some say it is possible but by creating different variables for each queries which is impossible for me as I will be inserting over 10000 records to my database from the CSV file. Is there any other ways to achieve this?

I'm thinking it can be done by looping through each records then doing a prepared-statement version of Insert Into but I thought doing 10000 Insert Into SQL commands would be very slow.

Answer 1

I am not 100% sure what you are asking but fallowing might work. First of all I would use pdo for connecting to a database. Fallowing is just a basic outline of what I think you want to do.

$pdo = new PDO('mysql:host=localhost;dbname=mydatabase', 'myusername', 'mypassowrd');
$query = "
    INSERT INTO table (colum1, colum2, colum3)
    VALUES (:info1, :info2, :info3)
";
$stmt = $pdo->prepare($query);
do 
{
    $stmt->execute(array(':info1'=>$my_info1, ':info2'=>$my_info2, ':info3'=>$my_info3));
} while( your condition);

There is two advantages for prepared statements. First is security and the second allows to do the same query over and over changing the values. This will make each of queries fast if you prepare them.

here is a ling that can explain more about prepared statements http://php.net/manual/en/pdo.prepared-statements.php

I am adding a Procedural way of doing it using mysqli.

$query = "
INSERT INTO table (colum1, colum2, colum3)
VALUES (?, ?, ?)
";
if ($stmt = mysqli_prepare($conn, $query)) 
{
    do
    {
    mysqli_stmt_bind_param($stmt, "sss", $my_info1, $my_info2, $my_info3);
    mysqli_stmt_execute($stmt);
    } while( your condition)
}  

I am not sure why you are using mysqli_store_result(), mysqli_free_result(), or mysqli_next_result(). Since inserting rows produces no results.