Question

can some one provided some suggestions of constructing MySQL querys that are both fast as well as secure.

Currently I am using typical MySQL calling method

$q = ("...");
$r = mysql_query($q);

but I was looking into OOP database programming so I am wondering which method would be the best to use and implemend on multiple pages with security and speed in mind.

Answer 1

The best way without much effort would be to use PHP PDO [PHP Data Object] extension. Here is the manual for it:

http://php.net/manual/en/book.pdo.php

Example:

<?php
/* Execute a prepared statement by binding PHP variables */
$calories = 150;
$colour = 'red';
$sth = $dbh->prepare('SELECT name, colour, calories
    FROM fruit
    WHERE calories < :calories AND colour = :colour');
$sth->bindParam(':calories', $calories, PDO::PARAM_INT);
$sth->bindParam(':colour', $colour, PDO::PARAM_STR, 12);
$sth->execute();
?>

You should learn the idea of “prepared statements” – it really improves security compared to mysql_query() way.