php - 大型表单 = 大型 PHP/mySql 查询字符串...有好的解决方案吗？

Question

我有一个正在构建的 CMS，其中有一个相当大的表格，里面充满了要添加到我的数据库中的数据。这是我收集变量的地方....



<pre><code>$orgName = $_POST['orgName'];
$impact = $_POST['impact'];
$headline = $_POST['headline'];
$content = $_POST['content'];
$subContent = $_POST['subContent'];
$meterText = $_POST['meterText'];
$month = $_POST['month'];
$shopLink = $_POST['shopLink'];
$blurbTitle = $_POST['blurbTitle'];
$blurb = $_POST['blurb'];
$logoURL = $_POST['logoURL'];
$buttonURL = $_POST['buttonURL'];
$blurbURL = $_POST['blurbURL'];
$POMURL = $_POST['POMURL'];
$horizontalURL = $_POST['horizontalURL'];
$statURL = $_POST['statURL'];
$stats = $_POST['stats'];
</code></pre>

<p>here I sql escape, validate and send to my function (omitted validation for space)...</p>

<pre><code>require_once 'DB_Connect.php';

$connection = new DB_Connect();

$connection->insertPartner(
$index,
mysql_real_escape_string($orgName),
mysql_real_escape_string($impact),
mysql_real_escape_string($headline),
mysql_real_escape_string($content),
mysql_real_escape_string($subContent),
$month,
mysql_real_escape_string($shopLink),
mysql_real_escape_string($blurbTitle),
mysql_real_escape_string($meterText),
mysql_real_escape_string($blurb),
mysql_real_escape_string($stats),
mysql_real_escape_string($logoURL),
mysql_real_escape_string($buttonURL),
mysql_real_escape_string($blurbURL),
mysql_real_escape_string($POMURL),
mysql_real_escape_string($horizontalURL),
mysql_real_escape_string($statURL)
))
</code></pre>



最后是函数...

public function insertPartner(
    $orgName = '',
    $impact = '',
    $headline = '',
    $content = '',
    $subContent = '',
    $month = '',
    $shopLink = '',
    $blurbTitle = '',
    $blurb = '',
    $stats = '',
    $logoURL = '',
    $buttonURL = '',
    $blurbURL = '',
    $POMURL = '',
    $horizontalURL = '',
    $statURL = '')
    {
        $query="INSERT INTO `hupcap_FCE`.`fce_partners` (
        `index`,
        `organization_name`,
        `impact`,
        `headline`,
        `content`,
        `sub_content`,
        `blurb_title`,
        `blurb`,
        `stats`,
        `month`,
        `meter_number`,
        `meter_text`,
        `shop_link`,
        `button_img_url`,
        `blurb_img_url`,
        `logo_url`,
        `month_img_url`,
        `horizontal_logo_url`,
        `stat_img_url`,
        `util`
        ) VALUES (
        '',
        '$orgName',
        '$impact',
        '$headline',
        '$content',
        '$subContent',
        '$blurbTitle',
        '$blurb',
        '$stats',
        '$month',
        0,
        '',
        '$shopLink',
        '$buttonURL',
        '$blurbURL',
        '$logoURL',
        '$POMURL',
        '$horizontalURL',
        '$statURL',
        0)";
        if(mysql_query($query)){
            return true;
        }else{
            die("failed to insert record" . mysql_error());
        }
    }

必须有一种更巧妙的方法来做到这一点。谁有最好的方法？

谢谢-J

Answer 1

选项#1

使用像 Doctrine 这样的 ORM在您的 PHP 应用程序中处理 CRUD。

选项 #2

如果使用 ORM 的范式转换太大，请尝试这样的事情:

// Alias $_POST fields to SQL columns
$sql_columns= array(
    'post_field1'=> 'sql_column1',
    'post_field2'=> 'sql_column2',
    'post_field3'=> 'sql_column3');

// Encode $_POST data for use in SQL
$sql_a= array();
foreach ($sql_columns as $k=> $k2) {
 if (isset($_POST[$k])) {
  $sql_a[]= sprintf("`%s` = '%s'", $k2, mysql_real_escape_string($_POST[$k]));
 }
}

// Build SQL string to execute
$sql= sprintf('INSERT INTO table_name SET %s', implode(', ', $sql_a));
var_dump($sql);

这可以很容易地扩展成一个函数或一个类来处理不同的表、列和 SQL 语句。