php - 用简单的英语解释什么是参数化查询？

Question

谁能用简单的英语向我解释什么是参数化查询以及如何在 MySQL 数据库中用 PHP 实现它以避免 SQL 注入(inject)？

Answer 1

prepared statements and stored procedures PHP 手册的部分虽然专门与 PDO 相关，但很好地涵盖了这一点，它说:

They can be thought of as a kind of compiled template for the SQL that an application wants to run, that can be customized using variable parameters. Prepared statements offer two major benefits:

• The query only needs to be parsed (or prepared) once, but can be executed multiple times with the same or different parameters. When the query is prepared, the database will analyze, compile and optimize it's plan for executing the query. For complex queries this process can take up enough time that it will noticeably slow down an application if there is a need to repeat the same query many times with different parameters. By using a prepared statement the application avoids repeating the analyze/compile/optimize cycle. This means that prepared statements use fewer resources and thus run faster.

• The parameters to prepared statements don't need to be quoted; the driver automatically handles this. If an application exclusively uses prepared statements, the developer can be sure that no SQL injection will occur (however, if other portions of the query are being built up with unescaped input, SQL injection is still possible).

如果您需要有关如何使用它们的具体示例，上面的链接页面还包含代码示例。