Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

MySQLi Prepared Statements and Transactions

Is there a way to do transactions with prepared statements?

I mean can I use the following example with $mysqli->autocommit(FALSE); and $mysqli->commit( ); and $mysqli->rollback( );

//Preparing the statment

$insert_stmt=$mysqli->prepare("INSERT INTO x VALUES(?,?)")
or die($mysqli->error);

//associate variables with the input parameters

$insert_stmt->bind_param("is", $my_number,$my_string); //i=integer

//Execute the statement multiple times....

for ($my_number = 1; $my_number <= 10; $my_number++) 
{
    $my_string="row ".$my_number;
    $insert_stmt->execute() or die ($insert_stmt->error);
}
$insert_stmt->close();

I have looked around but can't find any example of using prepared statements (not PDO): http://php.net/manual/en/mysqli.prepare.php with transactions, I only find examples like these mentioned here: http://book.opensourceproject.org.cn/lamp/mysql/mysqlstored/opensource/0596100892/mysqlspp-chp-13-sect-2.html where transactions and prepared statements are never inter-mixed.

Would it be wrong to use them together?

like image 633
Yerel Avatar asked Mar 20 '11 23:03

Yerel


People also ask

What is a MySQLi prepared statements?

A prepared statement is a feature used to execute the same (or similar) SQL statements repeatedly with high efficiency. Prepared statements basically work like this: Prepare: An SQL statement template is created and sent to the database.

What is $STMT in PHP MySQLi?

" $stmt " obviously (I think) stands for "statement". As a variable name it's arbitrary, you can name that variable anything you want. $stmt is just rather idiomatic. A prepared statement as such is a database feature.

Can we use prepared statement for select query in PHP?

You must always use prepared statements for any SQL query that would contain a PHP variable. To do so, always follow the below steps: Create a correct SQL SELECT statement. Test it in mysql console/phpmyadmin if needed.

Does MySQLi prepare prevent SQL injection?

Another way you can protect your code against SQL injections is by using prepared statements. Prepared statements are precompiled SQL commands. They can be used with a specific database access library (such as mysqli) or with the more generic library PDO.


1 Answers

Prepared statements and transactions are unrelated techniques and technologies.

You may wish to issue the START TRANSACTION and COMMIT/ROLLBACK commands directly instead of using the dedicated methods. They are functionally equivalent.

For your loop, you'd issue the START TRANSACTION before your prepare, then your COMMIT after the loop exits. You probably should not try to open a transaction after a prepared statement has been started but before it's been executed.

For some reason, they didn't add a "start transaction" command in favor of turning off autocommit. It's one of those weird things about mysqli that makes me always recommend PDO instead. :) Opening a transaction implicitly turns off autocommit for the duration of the transaction.

like image 188
Charles Avatar answered Sep 20 '22 05:09

Charles