如何制作一个 PDO 类方法,用于在 arg 中使用未知数量的参数插入/更新/删除

How to make a PDO class method for inserting/updating/deleting with an unknown number of parameters in the arg

提问人:mouchin777 提问时间:11/12/2019 更新时间:11/12/2019 访问量:596

问:

目前,我正在尝试创建一个 PDO 类,其中我将有一个方法来运行 INSERT、UPDATE 或 DELETE 等查询。

对于考试,这是我的 SELECT 方法

 public function getPreparedQuery($sql){
    $stmt = $this->dbc->prepare($sql);
    $stmt->execute([5]);
    $arr = $stmt->fetchAll(PDO::FETCH_ASSOC);
    if(!$arr) exit('No rows');
    $stmt = null;
    return $arr;
}

我简单地这样称呼它:

    $stmt = $database->getPreparedQuery($sql2);
var_export($stmt);

到目前为止,我知道 runQuery 应该像这样工作:

在不使用方法的情况下插入示例:

$idRol = "6";
$nomRol = "test6";                          
$stmt = $database->dbc->prepare("insert into roles (idRol, NomRol) values (?, ?)");
$stmt->execute(array($idRol,$nomRol));
$stmt = null;

但是我想把它变成一个通用的方法,我只需传递sql语句,如下所示:

$database->runQuery($query);

但查询可能恰好是

$query = “插入 INTO 角色 (idRol, NomRol) VALUES ('4','test')”;

$query = “INSERT INTO movies (movName, movLength, movArg) VALUES ('name1','15','movie about...')”;

那么,如何对 arg $query进行切片,以便获取正在使用的所有变量,以便进行通用 runQuery?

因为我可以想象我的方法应该是这样的

runQuery([$var1 , $var2, $var3....(there can be more)] , [$var1value, $var2value, $var3value...(there can be more)]){

        $stmt = $database->dbc->prepare("insert into movies($var1 , $var2, $var3....(there can be more)) values (?, ? , ? (those are the values and there ca be more than 3)"); //how do i get those "?" value and amount of them, and the name of the table fields [movName, movLength, movArg can be variable depending of the sentence]?
        $stmt->execute(array($var1,$var2, $var3, ...)); //this is wrong , i dont know how to execute it
        $stmt = null;
}
PHP PDO的

评论

0赞 Your Common Sense 11/12/2019
你想多了。 将解决您的问题$database->runQuery($query, $parameters);
0赞 Carl Binalla 11/12/2019
您可以将 still use 用于其他查询,但添加用于 的数组作为参数。getPreparedQueryexecute()
0赞 Your Common Sense 11/12/2019
runQuery 示例容易受到 SQL 注入的攻击

答:

3赞 Your Common Sense 11/12/2019 #1

您需要向函数添加第二个参数。只是一个数组,所有这些变量都会去。根据定义,数组可以具有任意数量的元素,这完全可以解决您的问题:

public function runQuery($sql, $parameters = []) {
    $stmt = $this->dbc->prepare($sql);
    $stmt->execute($parameters);
    return $stmt;
}

这个简单的函数将运行任何查询。您可以在我专门介绍 PDO 帮助程序函数的文章中查看使用示例:

// getting the number of rows in the table
$count = $db->runQuery("SELECT count(*) FROM users")->fetchColumn();

// the user data based on email
$user = $db->runQuery("SELECT * FROM users WHERE email=?", [$email])->fetch();

// getting many rows from the table
$data = $db->runQuery("SELECT * FROM users WHERE salary > ?", [$salary])->fetchAll();

// getting the number of affected rows from DELETE/UPDATE/INSERT
$deleted = $db->runQuery("DELETE FROM users WHERE id=?", [$id])->rowCount();

// insert
$db->runQuery("INSERT INTO users VALUES (null, ?,?,?)", [$name, $email, $password]);

// named placeholders are also welcome though I find them a bit too verbose
$db->runQuery("UPDATE users SET name=:name WHERE id=:id", ['id'=>$id, 'name'=>$name]);

// using a sophisticated fetch mode, indexing the returned array by id
$indexed = $db->runQuery("SELECT id, name FROM users")->fetchAll(PDO::FETCH_KEY_PAIR);

正如你所看到的,现在你的函数可以与任何具有任意数量参数的查询一起使用

评论

0赞 mouchin777 11/12/2019
我试图通过我的示例根据电子邮件获取用户,所以我输入.我也不明白该语句中如何使用 OR,难道我不必声明 idRol 两次吗?$idRol = ['1']; $stmt = $database->runQuery("SELECT * FROM roles where idRol =?", [$idRol])->fetch(); var_export($stmt)You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '?' at line 1
1赞 Your Common Sense 11/12/2019
似乎您在函数中使用了 query(),而不是 prepare()。因此错误。和 wiith OR - 是的,您需要指定 idRol 两次。