MySQL DatabaseLesson 64Free preview

MySQL Prepared

This lesson is part of PHP · All levels

Summary

Prepared statement separates query template from data so that the input value is never considered an SQL command. The trick is to set up the query with a placeholder, bind the parameter using the bind_param and the type, and then execute it. This is the most effective way to prevent SQL injection attacks on PHP applications.

Key points

Placeholder uses the? mark on mysqli, then tied with mysqli_stmt_bind_param().
The type of parameter is written in sequence, for example 'ii' for two integers and 'ss' for two strings.
Data is sent separately from the command so that the malicious input is never executed as SQL.
PDO also provides a prepared statement with a placeholder of the type: name.

Full lesson

Code examples and quizzes

Full lessons, code examples, and quizzes are available to subscribers. 5 questions.