MySQL prepared statement in PHP without 'mysqli' extension
|
Prepared statements are maybe the strongest weapon we have against the sql injecting plague.
They exist in MySQL since version 4.1 on and we can access them directly from PHP if 'mysqli' extension is installed.
Unfortunately not all hosting providers provides it. But we can still use prepared statements directly from SQL.
Here is a simple example:
PREPARE my_statement FROM "SELECT myfield FROM mytable WHERE myothefield = ?";
SET @myparam = "whatever";
EXECUTE my_statement USING @myparam;
DEALLOCATE PREPARE my_statement;
|
Tips'n Tricks 
