PHP - 准备 VS 未准备查询

Question

我想知道准备好的查询是否与未准备的查询一样安全。下面是两个示例，一个用于 SELECT，一个用于 UPDATE。第一行是未准备的查询，第二行是准备好的查询。

选择示例:

$userDetails = $connection->query("SELECT * FROM Users WHERE Name='$username'")->fetch();

$userDetails = $connection->prepare('SELECT * FROM Users WHERE Name=?');
$userDetails->execute(array($username));
$userDetails = $userDetails->fetch();

更新示例:

$query = $connection->query("UPDATE Users SET SessionID='$sessionID' WHERE Name='$username'")->execute();

$query = $connection->prepare("UPDATE Users SET SessionID=? WHERE Name=?");
$query->execute(array($sessionID, $username));

我应该用很长的方式来做还是只需要一条线就做得更糟？

Answer 1

来自文档

The prepared statement execution consists of two stages: prepare and execute. At the prepare stage a statement template is sent to the database server. The server performs a syntax check and initializes server internal resources for later use.

Repeated execution

A prepared statement can be executed repeatedly. Upon every execution the current value of the bound variable is evaluated and sent to the server. The statement is not parsed again. The statement template is not transferred to the server again.

prepared statement有检查语法和重复执行的优点。当你的 sql 是使用变量动态生成时，准备好的语句尤其受欢迎

您可以在这篇 SO 帖子中阅读更多信息 MySQLi: query VS prepare