php mysql 参数化_PHP MySQLi参数化查询不起作用

如果查看mysqli_stmt_fetch的文档,则会看到以下说明：

Fetch results from a prepared statement into the bound variables

$storeName = $_GET['store'];

$stmt = mysqli_prepare($conn, "SELECT * FROM stores WHERE storeName = ?");

mysqli_stmt_bind_param($stmt, "s", $storeName);

mysqli_stmt_execute($stmt);

mysqli_stmt_bind_result($stmt, $col1, $col2, $col3,...);

while (mysqli_stmt_fetch($stmt)) {

// do stuff with $col1, $col2, etc.

}

现在,在循环的每次迭代中,为绑定的结果变量提供结果集中的值.

但是,我强烈建议您改用PDO,这要冗长得多：

$storeName = $_GET['store'];

$stmt = $db->prepare("SELECT * FROM stores WHERE storeName = ?");

$stmt->execute([$storeName]);

$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);

// now you have a simple array with all your results

foreach ($rows as $row) {

// do stuff with $row

}