使用 PHP OOP 和本机 Z9778840A010410CB30C52ZB7CZ 将大型表单插入 SQL 数据库的最快方法

Question

First of all, I am new to PHP OOP and I'm still writing my code so I cannot paste the finished code here.

1. The form

<form method='post'>
    <?php
        print '<tr class="oddeven">';
        print '<input type="hidden" name="rowid" value="' . $row['rowid'] . '"/>';
        print '<td>' . $row['rowid'] . '</td>';
        print '<input type="hidden" name="firstname" value="' . $row['firstname'] . '"/>';
        print '<input type="hidden" name="lastname" value="' . $row['lastname'] . '"/>';
        print '<td>' . $row['firstname'] . ' ' . $row['lastname'] . '</td>';
        ... and so on ...
        print '</tr>';
?>
<input class="butAction" type="submit" name="submit2" value="<?php print $langs->trans('UpdateRecords'); ?>">
</form>

2. Post and insert the data

So if I have like 2 or 3 fields, it is no problem to write the appropriate post and method like:

$var1 = $_POST['rowid'];
$var2 = $_POST['firstname'];
$var3 = $_POST['lastname''];
$object->insertData($var1, $var2, $var3);

and

    public function insertData($rowid, $firstname, $lastname)
    {
        $this->db->begin();
        $sql  = 'INSERT ';
        $sql .= 'INTO tablename (rowid, firstname, lastname) ';
        $sql .= 'VALUES (' . $this->db->escape($rowid) . ', ' . $this->db->escape($firstname) . ', ' . $this->db->escape($lastname) . ')';
        $resql = $this->db->query($sql);
        if ($resql) {
            $this->db->commit();
        } else {
            $this->db->rollback();
            print_error($this->db);
            return -1;
        }
    }

But I have like 20 values I have to insert, plus there will be some additional calculations.

So what is the better and fastest way to do this? As mentioned above, or use a function like:

    public function __set($name, $value)
    {
        $this->$name = $value;
    }

and assign values in $_POST?

Answer 1

You are overcomplicating the design. Most importantly, your queries are already vulnerable to SQL injection. By overcomplicating this you are only introducing more bugs. Keep it simple!

Create a simple model class, which will have a method to process your POST request.

class UserController
{
    public function __construct(private mysqli $db)
    {
    }

    public function processPost()
    {
        // instead of an array create DTO here
        $data = [
            'firstname' => filter_input(INPUT_POST, 'firstname') ?: throw new Exception('missing firstname'),
            'lastname' => filter_input(INPUT_POST, 'lastname') ?: throw new Exception('missing lastname'),
            'gender' => filter_input(INPUT_POST, 'gender') ?: null,
            // etc.
        ];

        $userModel = new User($this->db);
        $userModel->insert($data);
    }
}

class User
{
    public function __construct(private mysqli $db)
    {
    }

    public function insert(array $data)
    {
        $stmt = $this->db->prepare('INSERT INTO users (firstname, lastname, gender) VALUES(?,?,?)');
        $stmt->bind_param(str_repeat('s', count($data)), ...$data);
        $stmt->execute();
    }
}

You can call it from your application the usual way you would call any other controller class.

$userController = new UserController($mysqli);
if($_POST) {
    $userController->processPost();
}