mysql 问号作用,问号在MySQL中“ WHERE column =？”的意义是什么？

最新推荐文章于 2023-05-19 11:21:51 发布

转载最新推荐文章于 2023-05-19 11:21:51 发布 · 306 阅读

文章标签：

#mysql 问号作用

本文探讨了SQL语句中问号(?)的作用及其在预处理语句中的使用方式。问号作为参数占位符，允许在执行前将实际参数绑定到SQL语句上，这种方法能有效防止SQL注入攻击，并提高查询效率。

I am dissecting some code and came across this,

$sql = 'SELECT page.*, author.name AS author, updator.name AS updator '

. 'FROM '.TABLE_PREFIX.'page AS page '

. 'LEFT JOIN '.TABLE_PREFIX.'user AS author ON author.id = page.created_by_id '

. 'LEFT JOIN '.TABLE_PREFIX.'user AS updator ON updator.id = page.updated_by_id '

. 'WHERE slug = ? AND parent_id = ? AND (status_id='.Page::STATUS_REVIEWED.' OR status_id='.Page::STATUS_PUBLISHED.' OR status_id='.Page::STATUS_HIDDEN.')';

I am wondering what the "?" does in the WHERE statement. Is it some sort of parameter holder?

解决方案

Prepared statments use the '?' in MySQL to allow for binding params to the statement. Highly regarded as more secure against SQL injections if used properly. This also allows for quicker SQL queries as the request only has to be compiled once and can be reused.