替换全局$ PDO对象以维护安全性

时间:2018-01-04 20:43:21

标签: php pdo

我有connection.php文件:

<?php

       $dsn='mysql:host=localhost;dbname=sakila';
   $hostname='localhost';
   $username='root';
   $password='';
    $PDO_ob = new PDO($dsn, $username, $password);
   try {
        $PDO_ob = new PDO($dsn, $username, $password);
        $PDO_ob->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
          echo " connection success";
    } catch (PDOException $ex) {
        echo 'Connection failed: ' . $ex->getMessage();
    }
   ?>  
And functions.php  as :

    <?php 
    include "../category_prodct_pdo/connection.php";

    function get_products(){
        global $PDO_ob;


        $sql="SELECT * FROM products";
        $products=$PDO_ob->query($sql); 
        return $products;
    }
    ?>

当我删除行glopal $ PDO_op;我收到n错误消息  &#34;未定义的变量:PDO_ob&#34;  我知道在函数中使用全局变量并不是最好的工具 那么如何在不使用函数内部全局的情况下完成这项工作 提前谢谢你

1 个答案:

答案 0 :(得分:-2)

除了评论建议之外,我建议使用Class作为数据库连接并使用get实例函数。

final class DatabaseFactory
{
    public $pdo;
    public static function Instance()
    {
        static $inst = null;
        if ($inst === null) {
            $inst = new DatabaseFactory();
        }
        return $inst;
    }

    /**
     * Private ctor so nobody else can instantiate it
     *
     */
    private function __construct()
    {
         $dsn='mysql:host=localhost;dbname=sakila';
       $hostname='localhost';
       $username='root'; // avoid connecting with root user 
       $password='{put password for db connection, it is more secure}';
       try {
            $this->pdo = new PDO($dsn, $username, $password);
            $this->pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
              echo " connection success";
        } catch (PDOException $ex) {
            echo 'Connection failed: ' . $ex->getMessage();
        }
    }
}