如何改进我的 PHP 代码以将数据插入 MySQL？

Question

I am a beginner in PHP and want to know if my function is written well.

I am creating a quiz application and have the following tables: users, courses, quizzes (where the prof_id, course_id and quiz_name are stored), questions, quizzes_questions, answers. Note that a question can have more than one correct answer.

So, I wrote a script that receives as parameters the name of the quiz, the username of the professor that created it, the course, the question, the points of that question, the answer, and whether that answer is correct or not.

My question is if I have implemented it correctly, as I am not really sure about using foreign keys.

First, I have to find the id of the professor from the users table, then the id for the course from courses, then id for quiz from quizzes, and then check if the question already exists in the table. Based on the last check, I insert it if it does not already exist, along with its answers, but if it already exists, I select the id of it and do the insertion of the answers in the specific table.

public function insert_question($quiz_name,$professor,$course,$question,$points,$answer,$is_correct)
        {       
            $query = "select id from users where username ='$professor'";
            $result = mysqli_query($this->connection, $query);
            if(mysqli_num_rows($result)>0){
                $row=mysqli_fetch_array($result);
                $professor_id = $row['id']; 
            }else{
                $json['error'] = 'professor not found';
            }

            $query = "select id from courses where course ='$course'";
            $result = mysqli_query($this->connection, $query);
            if(mysqli_num_rows($result)>0){
                $row=mysqli_fetch_array($result);
                $course_id = $row['id'];    
            }else{
                $json['error'] = 'course not found';
            }

            $query = "select id from quizzes where professor_id ='$professor_id' and course_id = '$course_id'";
            $result = mysqli_query($this->connection, $query);
            if(mysqli_num_rows($result)>0){
                $row=mysqli_fetch_array($result);
                $quiz_id = $row['id'];          
            }else{
                $json['error'] = 'quiz not found';
            }

            $query = "select id from questions where question ='$question'";
            $result = mysqli_query($this->connection, $query);
            if(mysqli_num_rows($result)>0){
                //question already exists so we need to add its answers
                $row=mysqli_fetch_array($result);
                $question_id = $row['id'];

                $query = "insert into answers (question_id, answer, isCorrect) values ('$question_id','$answer','$is_correct')";
                $insertedA = mysqli_query($this -> connection, $query);
                if($insertedA == 1 ){
                    $jsonA['success'] = 'answer added';
                }
                else{
                    $jsonA['error'] = 'answer couldn\'t be added';
                }   

            }else if(mysqli_num_rows($result)==0){
                    //insert the actual question
                    $query = "insert into questions (question, points) values ('$question','$points')"; 
                    $insertedQ = mysqli_query($this -> connection, $query);
                    if($insertedQ == 1 ){
                        $jsonQ['success'] = 'question added';
                        $last_question_id = mysqli_insert_id($this -> connection); //id of the question i just inserted
                        echo $last_question_id;
                    }
                    else{
                        $jsonQ['error'] = 'question couldn\'t be added';
                    }


                    //insert into quizzes_questions
                    $query = "insert into quizzes_questions(quiz_id, question_id) values ('$quiz_id','$last_question_id')"; 
                    $insertedQQ = mysqli_query($this -> connection, $query);
                    if($insertedQQ == 1 ){
                        $jsonQQ['success'] = 'queestionQuizz added';
                    }
                    else{
                        $jsonQQ['error'] = 'questionQuizz couldn\'t be added';
                    }

                    $query = "insert into answers (question_id, answer, isCorrect) values ('$last_question_id','$answer','$is_correct')";
                    $insertedA = mysqli_query($this -> connection, $query);
                    if($insertedA == 1 ){
                        $jsonA['success'] = 'answer added';
                    }
                    else{
                    $jsonA['error'] = 'answer couldn\'t be added';
                    }   

                }else{
                $json['error'] = 'something wrong';
            }

                echo json_encode($json);
                echo json_encode($jsonA);
                echo json_encode($jsonQ);
                echo json_encode($jsonQQ);

                mysqli_close($this->connection);

        }

Is it ok to run those select stataments to find the ids and then use them like that? Is there an easier way to do that as I might have many scripts in which I have to find the id of the professor, so that means I would have to copy-paste this code in each file?

Also, I've read about prepared statements, should I use them for every parameter I have in my function, as all of them are user-inputted?

Answer 1

First and foremost, use functions instead of multiple if/else blocks.

I'd put the mysqli_fetch_array call into a separate function as well as separate methods for professor, course and questions

Also, use statements to prepare (optimize and secure) your queries : https://www.php.net/manual/fr/mysqli.prepare.php

You can also have a look at current query builders such as doctrine to use it or just get inspired by its structure : https://www.doctrine-project.org/

That would look like something like this :

function fetch($query, $statements) {
   $q = mysqli_prepare($this->connection, $query);

   foreach($statements as $ statement) {
      mysqli_stmt_bind_param($q, $statement);
   }

   $res = mysqli_stmt_execute($q);
   return mysqli_num_rows($res) > 0 ? $res : null;

}

function getProfessor($professor) {
   $res = $this->fetch("select id from users where username = ? LIMIT 1", array($username));
   return $res ? mysqli_fetch_array($res)['id'] : null;
}

...

then in your main function you can just test if professors isn't null

 $professor = $this->getProfessor($profName);
 if (!$professor) {
   // errors
 } else {
   // succeed
 }

Remember that functions should only fulfill one purpose and you should minimize if/elses, let alone nested ifs

Here's an interesting text explaining some guidelines on software and web development : https://en.wikipedia.org/wiki/SOLID