Question

在前面提过一个有关清理字符串的问题之后，我现在正尝试使用How can I prevent SQL injection in PHP?上的原理

$connection = mysqli_connect('localhost', 'user', 'xxxxx');
$database = mysqli_select_db($connection, 'xxxxx');

$param1 = $_GET['q'];

//prepared mysqli statement
$stmt = mysqli_stmt_init($connection);    
$stmt = $connection->prepare('SELECT * FROM CONTACTS WHERE SURNAME = ?');
$stmt->bind_param('s', $param1); // 's' specifies the variable type => 'string'

$stmt->execute();
$result = $stmt->get_result();
$num_rows = mysqli_num_rows($result);

echo "Records Found:".$num_rows."<br/><br/><hr/>";

while ($row = $result->fetch_assoc()) {
   echo $result['COMPANY']." ".$result['FORENAME']." ".$result['SURNAME'];
}

但是，尽管$ connection和$ database都正确处理，但出现以下错误：

严重错误：调用未定义方法mysqli_stmt :: get_result（） /my_first_mysqli.php在xxxx行

我不是语法正确，还是与我摇摆的php 5.2.0版本有更多关系。（是的，我在升级服务器之前先升级代码。）

如果是后者，是否可以使用一个更简单的MySQLi方法在升级php版本之前起作用？

编辑

我现在对此进行了更新，这更加干净：

 $servername = "localhost"; $username = "xxxx"; $password = "xxxx"; $dbname = "xxxx";

 // Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

 // Check connection
 if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}

$param1 = $_GET['q'];

$stmt = mysqli_prepare($conn, "SELECT CONTACTID, COMPANY, FORENAME, SURNAME FROM CONTACTS WHERE SURNAME = ?");

/* bind parameters for markers */
mysqli_stmt_bind_param($stmt, "s", $param1);

/* execute query */
mysqli_stmt_execute($stmt);

/* bind result variables */
mysqli_stmt_bind_result($stmt, $CONTACTID, $COMPANY, $FORENAME, $SURNAME);

/* fetch value */
mysqli_stmt_fetch($stmt);

$num_rows = mysqli_num_rows($stmt);
echo "Records Found:".$num_rows."<br/><br/><hr/>";


/* close statement */
mysqli_stmt_close($stmt);


mysqli_close ($conn);

我显然没有得到记录集结果来循环，也不知道如何...其余的似乎都正常工作而不会抛出错误。

Answer 1

感谢所有贡献。现在，我有一个可行的程序解决方案，我认为我应该将该程序发布以供参考。

这有点麻烦，但这很好，我相信它遵循了良好的现代实践。

$servername = "localhost"; $username = "xxxx"; $password = "xxxx"; $dbname = "xxxx";
$conn = new mysqli($servername, $username, $password, $dbname);// Create connection

// Check connection
if ($conn->connect_error) {
   die("Connection failed: " . $conn->connect_error);
}

$param1 = $_GET['q'];

$stmt = mysqli_prepare($conn, "SELECT CONTACTID, COMPANY, FORENAME, SURNAME FROM CONTACTS WHERE SURNAME = ?");
mysqli_stmt_bind_param($stmt, "s", $param1);// bind parameters for markers
mysqli_stmt_execute($stmt);// execute query
mysqli_stmt_bind_result($stmt, $CONTACTID, $COMPANY, $FORENAME, $SURNAME);// bind result variables

// fetch values
while (mysqli_stmt_fetch($stmt)) {
   echo $CONTACTID."<br>";
   echo $COMPANY."<br>";
   echo $FORENAME."<br>";
   echo $SURNAME."<br>";
   echo "<hr/>";
}

mysqli_stmt_close($stmt);// close statement

mysqli_close ($conn);

如果有任何改进，欢迎反馈。

我的第一个准备好的MySQLi存在问题

1 个答案: