PHP MySQL Prepared Statements
Prepared statements рд▓реЗ SQL injection рдмрд╛рдЯ рдмрдЪрд╛рдЙрди рдорджреНрджрдд рдЧрд░реНрдЫ рд░ query execution рд▓рд╛рдИ рдЫрд┐рдЯреЛ рдмрдирд╛рдЙрдБрдЫред
Example
<?php
// prepare and bind
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);
// set parameters and execute
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();
$firstname = "Mary";
$lastname = "Moe";
$email = "mary@example.com";
$stmt->execute();
echo "New records created successfully";
$stmt->close();
$conn->close();
?>
// prepare and bind
$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);
// set parameters and execute
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();
$firstname = "Mary";
$lastname = "Moe";
$email = "mary@example.com";
$stmt->execute();
echo "New records created successfully";
$stmt->close();
$conn->close();
?>
"sss" рд▓реЗ рддреАрдирд╡рдЯрд╛ parameters string (s) рд╣реБрдиреН рднрдиреЗрд░ рдЬрдирд╛рдЙрдБрдЫред рдЕрдиреНрдп рдкреНрд░рдХрд╛рд░рд╣рд░реВрдорд╛ i (integer), d (double), b (blob) рдкрд░реНрдЫрдиреНред