Question

So this is my current code:

function addPage($uniquename, $ordernum, $title, $author, $content, $privilege, $description=NULL, $keywords=NULL){
    if (!$description) $description = NULL;
    if (!$keywords) $keywords = NULL;
    //UPDATE `table` SET `ordernum` = `ordernum` + 1 WHERE `ordernum` >= 2
    $query = "UPDATE ".$this->prefix."page SET ordernum = ordernum+1 WHERE ordernum >= ?";
    if ($stmt = $this->db->prepare($query)){
        $stmt->bind_param("i", $ordernum);
        $stmt->execute();
        if (!arCheck($stmt)) return false;
    } else {
        $this->stmtError("addPage", $stmt->error);
    }

    $query = "INSERT INTO ".$this->prefix."page VALUES (LCASE(?), ?, ?, ?, ?, ?, ?, ?)";
    if ($stmt = $this->db->prepare($query)){
        $stmt->bind_param("sisisssi", $uniquename, $ordernum, $title, $author, $content, $description, $keywords, $privilege);
        $stmt->execute();
        return arCheck($stmt);
    } else {
        $this->stmtError("addPage", $stmt->error);
    }
}

It is suppose to add a new page to the datatable. The MySQL is courtesy of Phil Hunt from Store the order of something in MySQL

I know that you can use multiquery to accomplish the same thing, however I was told that prepared statement is better in performance, and security. Is there another way to do this? Like a prepared multi query?

Also, what about doing Transactions? I’m not fully sure of what that is, I assume that it’s if, let’s say, the INSERT statement fails, it will undo the UPDATE statement as well?

NOTE: the arCheck function will close the statement.

Answer 1

Prepared statements are indeed faster for repeated queries, at least in most cases. They’re also safer because they automatically escape input values, preventing SQL injection attacks. If you want to use them in PHP you’ll need the MySQLi extension.

You appear to have the right idea about transactions. With MySQLi there are commit and rollback methods, otherwise you can use mysql_query("COMMIT") or mysql_query("ROLLBACK").