PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

280 Chapter 11 Accessing Your MySQL Database from the Web with PHP
$author = addslashes($author);
$title = addslashes($title);
$price = doubleval($price);
}
Because the price is stored in the database as a float, you don’t want to put slashes into
it.You can achieve the same effect of filtering out any odd characters on this numerical
field by calling doubleval(), which we discussed in Chapter 1,“PHP Crash Course.”
This also takes care of any currency symbols that the user might have typed into the
form.
Again, you connect to the database by instantiating the mysqli object and setting up
a query to send to the database. In this case, the query is an SQL INSERT:
$query = "insert into books values
('".$isbn."', '".$author."', '".$title."', '".$price."')";
$result = $db->query($query);
This query is executed on the database by calling $db->query() (or mysqli_query() if
you want to do things procedurally).
One significant difference between using INSERT and SELECT is in the use of
mysqli_affected_rows().This is a function in the procedural version or a class member
variable in the object-oriented version:
echo $db->affected_rows." book inserted into database.";
In the previous script, you used mysqli_num_rows() to determine how many rows were
returned by a SELECT.When you write queries that change the database, such as
INSERTs, DELETEs, and UPDATEs, you should use mysqli_affected_rows() instead.
We’ve now covered the basics of using MySQL databases from PHP.
Using Prepared Statements
The mysqli library supports the use of prepared statements.They are useful for speeding
up execution when you are performing large numbers of the same query with different
data.They also protect against SQL injection-style attacks.
The basic concept of a prepared statement is that you send a template of the query
you want to execute to MySQL and then send the data separately.You can send multiple
lots of the same data to the same prepared statement; this capability is particularly useful
for bulk inserts.
You could use prepared statements in the insert_book.php script, as follows:
$query = "insert into books values(?, ?, ?, ?)";
$stmt = $db->prepare($query);
$stmt->bind_param("sssd", $isbn, $author, $title, $price);
$stmt->execute();
echo $stmt->affected_rows.' book inserted into database.';
$stmt->close();