PHP 和 mysqli 准备语句

Question

I have created this function to select data from a database table:

function data_users($dbc,$id){    
    $q = "SELECT * FROM users WHERE id = $id";
    $r = mysqli_query($dbc,$q);
    return $r;
}

How can I create the same function but this time with prepared statement? After that a usually call the function like this:

$result = data_users($dbc,$id);
while ($users_info = mysqli_fetch_assoc($result)) {
    //do something
}

Can I use the same method after the change?

Answer 1

Note that you can write such a function only of your PHP mysqli is built upon mysqlnd driver. In such a case you can write it like this:

function data_users($dbc,$id){    
    $sql = "SELECT * FROM users WHERE id = ?";
    $stmt = $dbc->prepare($sql);
    $stmt->bind_param("i",$id);
    $stmt->execute();
    $result = $stmt->get_result();
    return $result->fetch_assoc();
}

note that you shouldn't be afraid of the object syntax, it's really simple.

Answer 2

if ($stmt = mysqli_prepare($db, "SELECT * FROM users WHERE id = ?")) {
mysqli_stmt_bind_param($stmt, "i", $id);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_result($stmt, $result);
mysqli_stmt_fetch($stmt);