PHP - 将PDO转换为正常代码

Question

我想知道是否有人可以帮助我。

我试图将一些代码集成到我的应用程序中，我需要集成的代码是用PDO语句编写的，我不知道它是如何发生的。

我想知道是否有人可以帮我转换它。

的代码如下

$sql = "insert into message2 (mid, seq, created_on_ip, created_by, body) values (?, ?, ?, ?, ?)"; 
$args = array($mid, $seq, '1.2.2.1', $currentUser, $body); 
$stmt = $PDO->prepare($sql); 
$stmt->execute($args); 
if (empty($mid)) { 
    $mid = $PDO->lastInsertId(); 
} 
$insertSql = "insert into message2_recips values "; 
$holders = array(); 
$params = array(); 
foreach ($rows as $row) { 
    $holders[] = "(?, ?, ?, ?)"; 
    $params[] = $mid; 
    $params[] = $seq; 
    $params[] = $row['uid']; 
    $params[] = $row['uid'] == $currentUser ? 'A' : 'N'; 
} 
$insertSql .= implode(',', $holders); 
$stmt = $PDO->prepare($insertSql); 
$stmt->execute($params); 

Answer 1

您shoudl使用PDO unles你不能一些技术原因。如果你不知道，请学习它。也许这会让你开始：

/* 
This the actual SQL query the "?" will be replaced with the values, and escaped accordingly 
- ie. you dont need to use the equiv of mysql_real_escape_string - its going to do it 
autmatically 
*/ 
$sql = "insert into message2 (mid, seq, created_on_ip, created_by, body) values (?, ?, ?, ?, ?)"; 

    // these are the values that will replace the ? 
    $args = array($mid, $seq, '1.2.2.1', $currentUser, $body); 

    // create a prepared statement object 
    $stmt = $PDO->prepare($sql); 

    // execute the statement with $args passed in to be used in place of the ? 
    // so the final query looks something like: 
    // insert into message2 (mid, seq, created_on_ip, created_by, body) values ($mid, $seq, 1.2.2.1, $currentUser, $body) 
    $stmt->execute($args); 


    if (empty($mid)) { 
     // $mid id is the value of the primary key for the last insert 
     $mid = $PDO->lastInsertId(); 
    } 

    // create the first part of another query 
    $insertSql = "insert into message2_recips values "; 

    // an array for placeholders - ie. ? in the unprepared sql string 
    $holders = array(); 

    // array for the params we will pass in as values to be substituted for the ? 
    $params = array(); 

    // im not sure what the $rows are, but it looks like what we will do is loop 
    // over a recordset of related rows and do additional inserts based upon them 
    foreach ($rows as $row) { 
     // add a place holder string for this row 
     $holders[] = "(?, ?, ?, ?)"; 

     // assign params 
     $params[] = $mid; 
     $params[] = $seq; 
     $params[] = $row['uid']; 
     $params[] = $row['uid'] == $currentUser ? 'A' : 'N'; 
    } 
    // modify the query string to have additional place holders 
    // so if we have 3 rows the query will look like this: 
    // insert into message2_recips values (?, ?, ?, ?),(?, ?, ?, ?),(?, ?, ?, ?) 
    $insertSql .= implode(',', $holders); 

    // create a prepared statment 
    $stmt = $PDO->prepare($insertSql); 

    // execute the statement with the params 
    $stmt->execute($params); 

PDO真的是更好。它具有与MySQLi相同的功能，但在数据库驱动程序之间具有一致的接口（即只要您的SQL符合不同的数据库，理论上可以使用与mysql，sqlite，postresql等完全相同的php代码）AND AND预处理语句的参数绑定更好。既然你不应该以任何方式使用mysql扩展，并且MySQLi比PDO更加繁琐，除非你明确地需要支持一个老版本的PHP，否则它真的是一件容易的事情。