我真的需要bindParam吗？

发布于 2024-08-25 13:15:19 字数 1310 浏览 9 评论 0原文

我正在尝试做一些 PDO CRUD 来学习一些 PDO。我有一个关于bindParam 的问题。这是我现在的更新方法：

public static function update($conditions = array(), $data = array(), $table = '')
{
    self::instance();

    // Late static bindings (PHP 5.3)
    $table = ($table === '') ? self::table() : $table;

    // Check which data array we want to use
    $values  = (empty($data)) ? self::$_fields : $data;

    $sql     = "UPDATE $table SET ";
    foreach ($values as $f => $v)
    {
        $sql .= "$f = ?, ";
    }

    // let's build the conditions
    self::build_conditions($conditions);

    // fix our WHERE, AND, OR, LIKE conditions
    $extra = self::$condition_string;

    // querystring
    $sql   = rtrim($sql, ', ') . $extra;

    // let's merge the arrays into on
    $v_val = array_values($values);
    $c_val = array_values($conditions);
    $array = array_merge($v_val, self::$condition_array);

    $stmt  = self::$db->prepare($sql);
    return $stmt->execute($array);
}

在我的“self::$condition_array”中，我从 ? 中获得了所有正确的值。所以查询看起来像这样：

UPDATE table SET this = ?, another = ? WHERE title = ? AND time = ?

正如你所看到的，我不使用bindParams，而是将正确的值以正确的顺序（$array）直接传递到execute（$array）方法中。这就像一个魅力，但是这里不使用 use bindParam 安全吗？

如果没有那我该怎么办呢？

来自瑞典

托比亚斯的感谢

原文

I'm trying to do a little PDO CRUD to learn some PDO. I have a question about bindParam. Here's my update method right now:

public static function update($conditions = array(), $data = array(), $table = '')
{
    self::instance();

    // Late static bindings (PHP 5.3)
    $table = ($table === '') ? self::table() : $table;

    // Check which data array we want to use
    $values  = (empty($data)) ? self::$_fields : $data;

    $sql     = "UPDATE $table SET ";
    foreach ($values as $f => $v)
    {
        $sql .= "$f = ?, ";
    }

    // let's build the conditions
    self::build_conditions($conditions);

    // fix our WHERE, AND, OR, LIKE conditions
    $extra = self::$condition_string;

    // querystring
    $sql   = rtrim($sql, ', ') . $extra;

    // let's merge the arrays into on
    $v_val = array_values($values);
    $c_val = array_values($conditions);
    $array = array_merge($v_val, self::$condition_array);

    $stmt  = self::$db->prepare($sql);
    return $stmt->execute($array);
}

in my "self::$condition_array" I get all the right values from the ?. SO the query looks like this:

UPDATE table SET this = ?, another = ? WHERE title = ? AND time = ?

as you can see I dont use bindParams instead I pass the right values in the right order ($array) directly into the execute($array) method. This works like a charm BUT is it safe not use use bindParam here?

If not then how can I do it?

Thanks from Sweden

Tobias

分享到QQ

分享到微博