Question

I’ve been investing the time to learn Prepared Statements in MySQLi. I’m using PHP Solutions Second Edition by David Powers as a reference.

This query pulls a random photo filename from a specific gallery. The gallery number is a variable ($i). This is working, I simply want to know if it is written properly. My websites are fairly simple but I want to avoid SQL injection.

$conn = dbConnect('query');
$randPic = "SELECT p_fname
        FROM photos
        WHERE g_id = ?
        ORDER by RAND()
        LIMIT 1";
$gid = $i;
$stmt = $conn->prepare($randPic);
$stmt->bind_param('i', $gid);
$stmt->bind_result($p_fname);
$stmt->execute();
$stmt->store_result();
$stmt->fetch();

On the page where the random photo is needed, I am able to call it by the variable:

echo $p_fname;

And again, it all works. I just want to know if this is coded properly.

Answer 1

Yes, your query is written fine.

Be careful when you output data. If outputting variable data for an HTML page, use htmlspecialchars() to avoid accidentally injecting HTML into your pages.