note 121111 added to class.mysqli

The main drawbacks of all libraries for working with the database in PHP are: 1. Verbosity To prevent SQL injection, developers have two ways: - Use prepared requests. - Manually escaping parameters going into the body of an SQL query. String parameters are run via mysqli_real_escape_string (), and the expected numeric parameters lead to the corresponding types - int and float. Both approaches have enormous disadvantages: - Prepared queries are awfully verbose. To use "out of the box" the abstraction of PDO or the extension of mysqli, without aggregating all methods to get data from the DBMS is simply impossible - to get the value from the table you need to write a minimum of 5 lines of code! And so for every request! - Manual screening of parameters going to the body of an SQL query is not even discussed. A good programmer is a lazy programmer. Everything should be as automated as possible. 2. Failed to get SQL query for debugging To understand why the SQL-query does not work in the program, it needs to be debugged - to find either a logical or a syntactic error. To find the error, it is necessary to "see" the SQL query itself, to which the database was "bent", with parameters set in its body. Those. To have a fully-formed SQL. If the developer uses the PDO, with the requests being prepared, then this is done ... IMPOSSIBLE! No maximum convenient mechanisms for this in their native libraries are FOREWORD. It remains either to pervert, or climb into the database log. Solution: Database - class for working with MySql - github.com/Vasiliy-Makogon/Database Eliminates the verbosity - instead of 3 or more lines of code for execution of one query when using the "native" library, you write only 1! Shields all parameters going to the body of the request, according to the specified type of placeholders - reliable protection against SQL injections. It does not replace the functionality of the "native" mysqli adapter, but simply complements it. What are placeholders? Placeholders are special typed markers that are written in the SQL query string instead of explicit values (query parameters). And the values themselves are passed "later", as subsequent arguments to the main method that executes the SQL query: <?php // Connect to the DBMS and get the Database_Mysql object // Database_Mysql - "wrapper" over the "native" mysqli object $db = Database_Mysql::create ("localhost", "root", "password") // Select the database -> setDatabaseName ("test") // Select the character set -> setCharset ("utf8"); // Get the result object Database_Mysql_Statement // Database_Mysql_Statement - "wrapper" over the "native" object mysqli_result $result = $db->query ("SELECT * FROM users WHERE name = '? S' AND age =? I "," Basil ", 30); // Get the data (in the form of an associative array, for example) $data = $result->fetch_assoc(); // Does the query not work? No problem - print it out: echo $db->getQueryString(); ?> SQL query parameters passed through the placeholders system are processed by special screening functions, depending on the type of placeholders. More information see on github.com/Vasiliy-Makogon/Database ---- Server IP: 72.52.91.14 Probable Submitter: 2a00:13c0:100:13:441f:d8eb:36bc:407a ---- Manual Page -- http://php.net/manual/en/class.mysqli.php Edit -- https://master.php.net/note/edit/121111 Del: integrated -- https://master.php.net/note/delete/121111/integrated Del: useless -- https://master.php.net/note/delete/121111/useless Del: bad code -- https://master.php.net/note/delete/121111/bad+code Del: spam -- https://master.php.net/note/delete/121111/spam Del: non-english -- https://master.php.net/note/delete/121111/non-english Del: in docs -- https://master.php.net/note/delete/121111/in+docs Del: other reasons-- https://master.php.net/note/delete/121111 Reject -- https://master.php.net/note/reject/121111 Search -- https://master.php.net/manage/user-notes.php