العبارات المُعدّة وربط المعاملات

لماذا نستخدم العبارات المُحضّرة؟

prepare() + execute()

<?php
$stmt = $pdo->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$_POST["email"]]);
$user = $stmt->fetch();

العناصر النائبة المسماة

<?php
$stmt = $pdo->prepare(
    "INSERT INTO users (name, email) VALUES (:name, :email)"
);
$stmt->execute([':name' => "Alice", ':email' => "alice@example.com"]);

bindParam مقارنةً بـ bindValue

<?php
$name = "Bob";
$stmt = $pdo->prepare("INSERT INTO users (name) VALUES (:name)");
$stmt->bindParam(":name", $name);
$name = "Carol";
$stmt->execute(); // inserts "Carol"

مثال على bindValue

<?php
$stmt = $pdo->prepare("SELECT * FROM products WHERE price < :max");
$stmt->bindValue(":max", 50.00, PDO::PARAM_INT);
$stmt->execute();

ثوابت الأنواع

إعادة تنفيذ العبارات

<?php
$stmt = $pdo->prepare("INSERT INTO logs (msg) VALUES (:msg)");
foreach ($messages as $msg) {
    $stmt->execute([':msg' => $msg]);
}

rowCount()

<?php
$stmt = $pdo->prepare("DELETE FROM users WHERE active = 0");
$stmt->execute();
echo $stmt->rowCount()." users deleted";

lastInsertId()

<?php
$stmt = $pdo->prepare("INSERT INTO articles (title) VALUES (:t)");
$stmt->execute([':t' => "My Post"]);
$newId = $pdo->lastInsertId();

لا تدمج إدخال المستخدم مطلقًا

كائن PDOStatement

الخلاصة

تحقق سريع