![](/img/trans.png)
[英]Converting from mysql_query's to prepared statements (mysqli/PDO)? Necessary?
[英]mysql_query to PDO and prepared statements
我在CMS中有这个功能,它将字段和值的变量列表插入到两个不同的表中; 一个是静态索引表,一个是动态的。 这是功能:
function insertFields($fields)
{
$stdfields = array();
$extfields = array();
/* Separate the fields based on if the fields is standard or extra. $this->fields is a csv list of the defined extra fields */
foreach($fields as $field => $value)
{
$fields[mysql_real_escape_string($field)] = mysql_real_escape_string($value);
if(strstr($this->fields, $field))
$extfields[$field] = $value;
else
$stdfields[$field] = $value;
}
//Build the 2 queries -- Maybe there is a better way to do this?
$extfieldcount = count($extfields);
$stdfieldcount = count($stdfields);
$stditers = 0;
$extiters = 0;
foreach($extfields as $field => $value)
{
if($extiters != $extfieldcount)
{
$extfields.= $field.", ";
$extvalues.= "'".$value."', ";
}
else
{
$extfields.= $field." ";
$extvalues.= "'".$value."' ";
}
$extiters++;
}
foreach($stdfields as $field => $value)
{
if($stditers != $stdfieldcount)
{
$newfields.= $field.", ";
$newvalues.= "'".$value."', ";
}
else
{
$newfields.= $field." ";
$newvalues.= "'".$value."' ";
}
$stditers++;
}
//Inset the standard fields
$stdquery = "INSERT INTO masteridx (".$newfields.") VALUES (".$newvalues.")";
$this->dbQuery($stdquery);
/* not perfect. I need a better way to find the id that was inserted, so I can combine three queries into at least two */
$findlastquery = "SELECT `id` FROM `masteridx` WHERE `slug`='".$fields['slug']."' LIMIT 1";
$result = $this->dbQuery($findlastquery);
$result = mysql_fetch_assoc($result);
$tempfield = "id, ";
$tempvalue = "'".$result['id']."', ";
//Insert the extra fields
$extquery = "INSERT INTO ".$this->type." (".$tempfield.$extfields.") VALUES (".$tempvalue.$extvalues.")";
$this->dbQuery($extquery);
}
所以对于准备好的声明,我不能绑定字段,只是绑定值,对吧? 如果我做了类似的事情,我仍然要逃离田地:
for ($i = 0; $i <= $stdfieldcount; $i++)
{
if($i < $stdfieldcount)
$qs.= '?, ';
else
$qs.= '? ';
}
$sth = $dbh->prepare("INSERT INTO masteridx ({$stdfields}) VALUES ({$qs})");
$sth->execute($array_of_stdfield_values);
如果我还要逃离田野,这里有什么意义呢? 此函数最终将采用多个文章及其字段的数组。 字段本身每次都会有所不同。我想当我第一次看到预处理语句时,我可以只提供一个字段数组和一组值,但我想情况并非如此。
我的问题是,你们将如何实现这一目标? 我想开始与数据库无关,而PDO看起来是一个很好的方法。
PHP提供了许多便利功能,可以完成你手工完成的很多工作。
join()
函数对于构建以逗号分隔的列表非常有用。 示例(未测试):
function insertFields($fields) {
$columns = join(",", array_map(
function($col) { return "`".preg_replace("/`/gu","``",$col)."`"},
array_keys($fields)));
$params = join(",", array_map(
function($col) { return ":".preg_replace("/[`\s]/gu","",$col)},
array_keys($fields)));
$stdquery = "INSERT INTO masteridx ({$columns}) VALUES ({$params})";
$stmt = $pdo->prepare($stdQuery);
$stmt->execute($fields);
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.