Question

Hi hi am converting my MySQL code to MySQLi because it is more secure, but AFAIK MySQLi is not more secure by itself.

I used the converter in the selected answer this topic:
Updating from MYSQL to MYSQLI

and the code is working, but now i don’t exactly know what to do, i know i have to prepare the querys but exactly where and how to prepare i don’t know…

For example if i have an INSERT query with 5 or more php variables is it ok? how do i do? all the examples i find is with one variable… and do i prepare in the line immediately before the query?

Am I being too confusing? I’m Sorry if this is very basic stuff but i am completely noob with this and all i want is some guidelines…

Answer 1

Here’s an example of an INSERT query with multiple parameters.

/* create a prepared statement */
if ($stmt = $mysqli->prepare("INSERT INTO mytable (field1, field2, field3) VALUES(?, ?, ?)")) {

    /* bind parameters for markers */
    $stmt->bind_param("sss", $field1, $field2, $field3);

    /* execute query */
    $stmt->execute();

    /* close statement */
    $stmt->close();
}

As you can see $field1, $field2, and $field3 will be bound as strings (note the three s) and will replace the ? in the query.

Bind param types:

i – corresponding variable has type integer
d – corresponding variable has type double
s – corresponding variable has type string
b – corresponding variable is a blob and will be sent in packets